Pith. sign in

REVIEW 3 major objections 4 minor 98 references

Securing Private Federated Learning in a Malicious Setting: A Scalable TEE-Based Approach with Client Auditing

T0 review · 3 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a minimal TEE-based "planner enclave" plus randomized client auditing makes DP-FTRL differentially private even against a fully malicious server, with constant client overhead.

desk verdict Interesting and novel system, but the main probabilistic security bound has an off-by-one error that invalidates the claimed privacy guarantee; needs a fix before it can be relied on. read the letter →

arxiv 2509.08709 v2 pith:SG6G7REG submitted 2025-09-10 cs.LG cs.CR

Shun Takagi , Satoshi Hasegawa This is my paper
classification cs.LGcs.CR
keywords differentialprivacyfederatedlearningDP-FTRLtrustedexecutionenvironmentsmalicioussecurityinteractiveclientauditinglinearizability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DP-FTRL is attractive for cross-device federated learning because it avoids subsampling and shuffling, but it is stateful: the server must track participation history and correlated noise across rounds, and existing secure-aggregation extensions assume the server honestly plans each cohort. This paper tries to remove that assumption entirely. It argues that a small ephemeral TEE component on the server—the planner enclave—can generate a hash-linked evidence chain recording every state transition, and that a randomly audited subset of clients can verify those proofs by remote attestation before secure aggregation completes. The result is a system that, with probability 1 − δ_privacy, maintains integrity and linearizability of the shared state even under a malicious server, and therefore satisfies (ε, δ + δ_privacy)-interactive differential privacy. If correct, this would let practitioners run DP-FTRL without trusting the server, without extra trusted hardware, and with only constant lightweight work per client.

What carries the argument

Planner enclave with evidence chain and randomized client auditing. The planner enclave is a minimal TEE program that keeps no persistent state of its own beyond sealed data; its job is to sign evidence blocks. Evidence blocks record the cohort, aggregated-argument hash, next auditors, the digest of the chain, and the evidence-chain ID, and each block hashes the previous one. Clients audit by remote attestation: they check the evidence-chain ID against the one stored at initialization, ensure the digest is new (replay protection), and return a signature over the enclave's nonce only after the checks pass. The enclave only proceeds with secure aggregation after collecting τ signatures from th

What would settle it

Take a client that missed the genesis block and ask it to audit a forked chain created after initialization: since its evidence_chain_id is None, Algorithm 4 will accept the fork's ID and sign, whereas an initialized client would abort. Counting such unanchored clients as honest in Theorem 4.2's hypergeometric formula overstates the probability that honest auditors form a majority; recomputing δ_privacy with only genuinely anchored clients would settle whether the bound holds under client churn.

Watch

Extended reading notes

Core claim

The central claim is Theorem 5.1: the client algorithms M_i of Algorithm 4, composed as ConComp(M_1,...,M_n) and used with any server protocol, emulate the ideal model of Algorithm 1 with a simulator. The ideal model runs MF-DP-FTRL as a trusted party except for a small probability δ_privacy of leaking the dataset to the simulator, folded into the DP budget as δ+δ_privacy. The route: model the protocol as a concurrent system over a shared object q (round index, participation history, noise matrix); prove integrity plus linearizability of update processes implies emulation; then show the planner-enclave design—evidence chain, remote attestation, randomized client auditing—maintains those prop

Load-bearing premise

The central premise is that every auditing client already holds the correct evidence-chain ID from initialization; clients that were offline then will accept whatever chain the server first shows them, and the paper provides no way to re-anchor them, so the honest-majority probability in Theorem 4.2 may not cover the actual pool of auditors.

Editorial extensions

If this is right

  • A malicious server that deviates arbitrarily—selecting Sybils, replaying states, forking, or claiming crashes—cannot make the protocol view leak more than (ε, δ+δ_privacy)-DP; Theorem 5.1 holds for any server protocol.
  • With parameters set so that δ_privacy and δ_interrupt are around 10^-8 (e.g., roughly 129 auditors at small corruption and dropout rates), the system simultaneously meets security and liveness with high probability, and the auditor pool can be found by the paper's parameter-selection procedure.
  • Each client's extra work is constant and independent of model or client count: auditing evidence is about 5 KB, responses are 64–144 bytes, and the TCB is about 0.7K lines of enclave code excluding libraries.
  • Enclave crashes do not stop the long-running execution: a new process can be re-initialized from the evidence chain, and because linearizability is non-blocking, an aggregation round that loses clients after evidence is committed can be regenerated without breaking the protocol.
  • The design avoids external trusted hardware and consensus-based TEE replication, so it inherits neither the Cuckoo-attack risk of TPM-based state continuity nor the large TCB and disaster vulnerability of SMR-on-TEE systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The security accounting counts as honest only clients that can genuinely authenticate the evidence chain. Clients who miss the initialization round have no anchor: the first evidence they are shown sets their evidence_chain_id, so an adversary that forks before their first audit can obtain their signatures; the paper gives no re-initialization or catch-up procedure, which would shrink the effectiv
  • The proof assumes attested execution is truly confidential and integrity-preserving. If the chosen TEE is later broken by side-channel or fault-injection attacks, the planner chain itself is sound but the full system needs a non-TEE noise-adding mechanism; the paper notes this tension when discussing SMPC-based secure aggregation but does not supply that mechanism.
  • The δ_privacy term is added to the DP δ budget rather than kept as a separate operational failure probability. Applications requiring very small δ must therefore spend more on auditor pool size and audit frequency, making the practical privacy cost of the scheme exactly the trade-off plotted in the paper's parameter experiments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a TEE-based server extension (a “planner enclave”) combined with randomized client auditing to implement DP-FTRL under a fully malicious server. The protocol maintains an evidence chain, and clients audit enclave evidence before secure aggregation proceeds. The authors formalize security via interactive differential privacy: they define an ideal functionality (Algorithm 1), state that the real protocol emulates it (Theorem 5.1), and conclude (ε, δ+δ_privacy)-interactive DP. Probabilistic linearizability/integrity is quantified in Theorem 4.2, liveness is analyzed in Proposition 5.2, parameter selection is reduced to an optimization problem, and an Intel SGX implementation is evaluated. The paper claims a small TCB, constant client overhead, and recovery from enclave crashes.

Significance. If the main theorem were established, this would be a valuable contribution: it addresses a real gap by removing the semi-honest-server assumption for stateful DP-FTRL, and it does so with a small TCB and without external trusted hardware. The paper deserves credit for making the security model explicit, for shipping a Tamarin formalization (Appendix E) that machine-checks the γ=0 case, and for including concrete parameter and communication-cost experiments. However, the central probabilistic security argument has a boundary-condition error (Theorem 4.2), and the formal verification does not cover the corrupted-auditor regime on which the malicious-security claim rests. The contribution is therefore conditional on a repair of the probability calculation and a reassessment of the parameter recommendations.

major comments (3)
  1. [§4.2.2, Theorem 4.2 and Appendix D.3] The proof of Theorem 4.2 defines the unsafe event as a > 2τ − n_audit and sums i=1..2(n_audit−τ). The fork condition is actually a ≥ 2τ − n_audit. Concretely, with n_audit=3, τ=2, and one corrupted auditor (a=1), the server can obtain {corrupt, honest1} for one enclave and {corrupt, honest2} for another enclave loading the same evidence-chain state: the corrupted auditor signs both, and each honest auditor signs once before the replay check in Algorithm 4 blocks the second request. Both enclaves pass the τ-signature check at Algorithm 3, Line 16, yet the theorem assigns this fork probability zero. Since Theorem 5.1 uses δ_privacy as the probability that linearizability fails and that the ideal functionality leaks D, the claimed (ε, δ+δ_privacy)-interactive DP guarantee is not established by the proof as written. The sum should include the i=0 term (or the event should be stated as a ≥ 2τ
  2. [§5.1, Theorem 5.1 and Appendix E] The Tamarin verification in Appendix E explicitly models a single representative honest auditor (the Remark before E.1). That is sufficient for the γ=0 claim in Theorem 4.1, but the malicious-security claim in Theorem 5.1 depends on Theorem 4.2’s probabilistic bound for γ>0. The appendix justifies the single-auditor abstraction by appealing to Theorem 4.2 itself, which is the very result whose boundary case is incorrect and which is not machine-checked. As written, the paper’s claim of formal verification for the malicious setting is therefore overstated: the verified artifact covers only honest auditors, and the corrupted-quorum case (including the equality case above) is outside its model.
  3. [§2.2 and §4.1.2, Algorithm 4] Clients who are offline during initialization cannot later authenticate the evidence chain. Algorithm 4 stores evidence_chain_id on the first successful Audit (Line 5-8), and subsequent Audits abort on a mismatch. If a client is unavailable at initialization, as permitted by the variable-availability model (κ < 1 at any time), its evidence_chain_id remains None and it will accept any chain presented later, including a fork initialized by the malicious server. No catch-up or re-initialization mechanism is specified. This reduces the effective pool of honest auditors for the Sybil-resistance calculation in Theorem 4.2 and weakens the liveness/scalability claims for realistic dropout patterns. The paper should either specify a re-initialization protocol or state explicitly that security is guaranteed only for clients present at initialization, and adjust the threat model and parameter analy
minor comments (4)
  1. [Theorem 4.2 formula] The hypergeometric terms use nγ, n(κ−γ), and nκ inside binomial coefficients. Since these are generally non-integers, the formula needs floors/ceilings (or a sampling model with integer counts) to be well-defined.
  2. [Figure 4 caption] The caption states “various γ with β=0 and κ=1 (left) and various γ with β=0 and κ=1 (right)”; the two sides appear to be identical. The right panel presumably varies a different parameter, and the caption should be corrected.
  3. [§5.4] The optimization constraint text says δ_privacy(n_audit, τ) ≤ p1 and δ_interrupt(n_audit, τ) ≤ p2, but the preceding sentence assigns p1 to liveness and p2 to security. The naming is inconsistent and should be aligned.
  4. [Appendix D.4] The simulator construction in the proof of Theorem 5.1 is informal: in the linearizable case it says Sim forwards outputs from T(D), but it does not specify how Sim handles the adversary’s choices of cohort, index k, and corrupted-client inputs in the real protocol. A more detailed reduction would help, especially since the main theorem is the paper’s central claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the proof chain is compositional, the added delta is a design parameter computed from threat-model probabilities, and no step reduces by construction to its own inputs.

full rationale

The derivation chain is compositional rather than circular. Theorem 3.1 (Appendix D.1) explicitly imports the base DP guarantee from prior work: it says 'this aligns with the matrix mechanism in adaptive streaming [28]' and 'the privacy guarantee is maintained just as in that of Denisov et al. [28]'. That is an external theorem with stated assumptions (adaptive streaming, matrix mechanism, zero-out adjacency) that do not include the paper's target claim (malicious server, TEE, client auditing), so it is independent support rather than a self-referential loop. delta_privacy is not a fitted parameter: Theorem 4.2 computes it as a hypergeometric probability over the threat-model parameters (gamma, kappa, n_audit, tau), and Algorithm 1 then uses it as the standard 'add the delta' leak probability via joint convexity in Appendix D.1. That is a construction, not a prediction of a fitted quantity. Theorem 5.1 is a standard simulation argument whose crux is the probabilistic linearizability guarantee of Theorem 4.2; whether Theorem 4.2's bound omits the equality case (the skeptic's a = 2*tau - n_audit counterexample) is a correctness concern about the probability computation, not a circularity, because it challenges the inequality rather than showing that the claimed result is equivalent to an input by definition. The Tamarin verification in Appendix E explicitly abstracts to 'a single, representative auditor who correctly follows the protocol (i.e., gamma=0)'; this is an acknowledged limitation of the machine-checked portion, but the gamma>0 case is handled by the paper's own probability calculation in Theorem 4.2, so the formal verification is not the sole load-bearing step. No step in the paper reduces, by construction or by self-citation, to the claim being proved.

Assumptions & free parameters 2 free parameters · 6 assumptions · 2 invented entities

The central claim rests on TEE security, PKI, standard cryptographic hardness, and prior DP-FTRL guarantees; the paper's contribution is the protocol layer combining these with randomized client auditing. Design parameters tau and n_audit are tunable but not fitted to data.

free parameters (2)
  • tau (signature threshold) = > n_audit/2
    Number of auditor signatures required to approve a state transition; trade-off between liveness and security in Section 5.4.
  • n_audit (number of auditors) = e.g., 129 for beta=gamma=0.1 (Section 6.1)
    Randomly selected auditors per round; larger n_audit reduces delta_privacy at higher communication cost.
assumptions (6)
  • domain assumption TEE provides confidentiality, integrity, and sound remote attestation (Section 2.1); side-channel attacks are out of scope.
    The whole protocol relies on enclave properties; the paper explicitly defers side-channel attacks to Appendix A.1.
  • domain assumption Dolev-Yao adversary: cannot break digital signatures, nonces, Diffie-Hellman, and symmetric encryption (Section 2.2).
    Needed for the simulation-based proof in Appendix D.4.
  • domain assumption Trusted PKI certifies the public key list and client count (Section 2.2).
    Used in the initialization verification and to bound the fraction of corrupted clients.
  • domain assumption Adversary corrupts at most a fraction gamma of clients, at least kappa fraction are available, and beta fraction may drop out (Section 2.2).
    These bounds feed the hypergeometric calculations in Theorem 4.2 and Proposition 5.2.
  • standard math Base DP-FTRL privacy guarantee of the matrix mechanism (Denisov et al. [28]) holds.
    The ideal functionality in Algorithm 1 inherits its DP from this external prior result, used in Theorem 3.1.
  • domain assumption Enclave random auditor selection is uniform and hidden from the adversary.
    The probability bounds in Theorem 4.2 assume C_audit is a uniform random subset of the candidate pool.
invented entities (2)
  • planner enclave
    purpose: Ephemeral TEE module that loads sealed state, generates verifiable proofs, and performs secure stateful aggregation.
    New system component; no external falsifiable handle, only the internal protocol and Tamarin analysis.
  • evidence chain
    purpose: Hash-linked sequence of enclave-generated evidence making the shared state history verifiable and binding.
    New data structure introduced by the paper; its security is argued through the protocol and Tamarin model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Private Federated Learning in a Malicious Setting: A Scalable TEE-Based Approach with Client Auditing." pith.science (2026). https://pith.science/paper/SG6G7REG

@misc{pith2026250908709,
  author       = {Pith},
  title        = {Pith review of: Securing Private Federated Learning in a Malicious Setting: A Scalable TEE-Based Approach with Client Auditing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SG6G7REG}},
  note         = {Machine review of arXiv:2509.08709}
}
read the original abstract

In cross-device private federated learning, differentially private follow-the-regularized-leader (DP-FTRL) has emerged as a promising privacy-preserving method. However, existing approaches assume a semi-honest server and have not addressed the challenge of securely removing this assumption. This is due to its statefulness, which becomes particularly problematic in practical settings where clients can drop out or be corrupted. While trusted execution environments (TEEs) might seem like an obvious solution, a straightforward implementation can introduce forking attacks or availability issues due to state management. To address this problem, our paper introduces a novel server extension that acts as a trusted computing base (TCB) to realize maliciously secure DP-FTRL. The TCB is implemented with an ephemeral TEE module on the server side to produce verifiable proofs of server actions. Some clients, upon being selected, participate in auditing these proofs with small additional communication and computational demands. This extension solution reduces the size of the TCB while maintaining the system's scalability and liveness. We provide formal proofs based on interactive differential privacy, demonstrating privacy guarantee in malicious settings. Finally, we experimentally show that our framework adds small constant overhead to clients in several realistic settings.

Figures

Figures reproduced from arXiv: 2509.08709 by the authors.

Figure 1
Figure 1. The process overview of each round of our system. Since breaking consistency can lead to privacy leaks as men￾tioned above, a necessary condition for the concurrent system to satisfy interactive DP is to maintain process consistency with re￾spect to the shared object, ensuring that a malicious server cannot complete any process that compromises this consistency. Thus, we focus on ensuring the consistency of the conc… view at source ↗
Figure 2
Figure 2. Overview of the core idea behind planner enclaves. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. The flow of evidence-related proofs by the server. A [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The trade-off between communication cost and [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Communication cost for various settings of [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Sequence diagram of the state transition protocol between the Server, Planner Enclave, and Auditors. [PITH_FULL_IMAGE:figures/full_fig_p022_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

98 extracted references · 8 linked inside Pith

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    Naman Agarwal, Peter Kairouz, and Ziyu Liu. 2021. The skellam mechanism for differentially private federated learning.Advances in Neural Information Processing Systems34 (2021), 5052–5064

    2021

  3. [3]

    AMD. 2016. AMD Secure Encrypted Virtualization (SEV). https://www.amd.com/en/developer/sev.html(2016)

    2016

  4. [4]

    Sebastian Angel, Aditya Basu, Weidong Cui, Trent Jaeger, Stella Lau, Srinath Setty, and Sudheesh Singanamalla. 2023. Nimble: Rollback protection for confidential cloud services. In17th USENIX Symposium on Operating Systems Design and Implementation (OSDI 23). 193–208

    2023

  5. [5]

    2024.Private Cloud Compute: A new frontier for AI privacy in the cloud, https://security.apple.com/blog/private-cloud-compute/

    Apple. 2024.Private Cloud Compute: A new frontier for AI privacy in the cloud, https://security.apple.com/blog/private-cloud-compute/. Technical Report. Apple

    2024

  6. [6]

    2016.{SCONE}: Secure linux containers with intel{SGX}

    Sergei Arnautov, Bohdan Trach, Franz Gregor, Thomas Knauth, Andre Martin, Christian Priebe, Joshua Lind, Divya Muthukumaran, Dan O’keeffe, Mark L Stillwell, et al. 2016.{SCONE}: Secure linux containers with intel{SGX}. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16). 689–703

    2016

  7. [7]

    Marshall Ball, James Bell-Clark, Adria Gascon, Peter Kairouz, Sewoong Oh, and Zhiye Xie. 2024. Secure Stateful Aggregation: A Practical Protocol with Applica- tions in Differentially-Private Federated Learning.arXiv preprint arXiv:2410.11368 (2024)

    arXiv 2024

  8. [8]

    Borja Balle, James Bell, Adria Gascón, and Kobbi Nissim. 2020. Private summation in the multi-message shuffle model. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 657–676

    2020

Show all 98 references
  1. [9]

    Amos Beimel, Kobbi Nissim, and Eran Omri. 2008. Distributed private data analysis: Simultaneously solving how and what. InAdvances in Cryptology– CRYPTO 2008: 28th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2008. Proceedings 28. Springer, 451–468

    2008

  2. [10]

    James Henry Bell, Kallista A Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova. 2020. Secure single-server aggregation with (poly) logarithmic overhead. InProceedings of the 2020 ACM SIGSAC conference on computer and communications security. 1253–1269

    2020

  3. [11]

    Pramod Bhatotia, Markulf Kohlweiss, Lorenzo Martinico, and Yiannis Tselek- ounis. 2021. Steel: composable hardware-based stateful and randomised func- tional encryption. InIACR International Conference on Public-Key Cryptography. Springer, 709–736

    2021

  4. [12]

    Alexander Bienstock, Antigoni Polychroniadou, and Ujjwal Kumar. 2024. DMM: Distributed Matrix Mechanism for Differentially-Private Federated Learning using Packed Secret Sharing. InInternational Workshop on Federated Foundation Models in Conjunction with NeurIPS

    2024

  5. [13]

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Prac- tical secure aggregation for privacy-preserving machine learning. Inproceedings of the 2017 ACM SIGSAC Conference on Compute...

    2017

  6. [14]

    Kallista Bonawitz, Peter Kairouz, Brendan McMahan, and Daniel Ramage. 2021. Federated learning and privacy: Building privacy-preserving systems for machine learning and data science on decentralized data.Queue19, 5 (2021), 87–114

    2021

  7. [15]

    Lennart Braun, Adrià Gascón, Mariana Raykova, Phillipp Schoppmann, and Karn Seth. 2024. Malicious security for sparse private histograms.Cryptology ePrint Archive(2024)

    2024

  8. [16]

    Javad Ghareh Chamani and Dimitrios Papadopoulos. 2020. Mitigating leakage in federated learning with trusted hardware. InAdvances in Neural Information Processing Systems, Privacy Preserving Machine Learning - PriML and PPML Joint Edition

    2020

  9. [17]

    2021.{VoltPillager}: Hardware-based fault injection attacks against intel{SGX} enclaves using the{SVID} voltage scaling interface

    Zitai Chen, Georgios Vasilakis, Kit Murdock, Edward Dean, David Oswald, and Flavio D Garcia. 2021.{VoltPillager}: Hardware-based fault injection attacks against intel{SGX} enclaves using the{SVID} voltage scaling interface. In30th USENIX Security Symposium (USENIX Security 21)...

    2021

  10. [18]

    Christopher A Choquette-Choo, Krishnamurthy Dj Dvijotham, Krishna Pillutla, Arun Ganesh, Thomas Steinke, and Abhradeep Guha Thakurta. 2024. Correlated Noise Provably Beats Independent Noise for Differentially Private Learning. In The Twelfth International Conference on Learnin...

    2024

  11. [19]

    Christopher A Choquette-Choo, Arun Ganesh, Ryan McKenna, H Brendan McMa- han, John Rush, Abhradeep Guha Thakurta, and Zheng Xu. 2024. (Amplified) Banded Matrix Factorization: A unified approach to private training.Advances in Neural Information Processing Systems36 (2024)

    2024

  12. [20]

    Christopher A Choquette-Choo, H Brendan McMahan, Keith Rush, and Abhradeep Thakurta. 2022. Multi-epoch matrix factorization mechanisms for private machine learning.arXiv preprint arXiv:2211.06530(2022)

    2022 arXiv

  13. [21]

    INTEL CORP. 2015. Product Change Notification 114074- 00.https://qdms.intel.com/dm/i.aspx/ 5A160770-FC47-47A0-BF8A- 062540456F0A/PCN114074-00(2015)

    2015

  14. [22]

    2023.Differential Privacy in LINE Federated Learning

    LINE Corporation. 2023.Differential Privacy in LINE Federated Learning. Techni- cal Report. https://linecorp.com/en/security/article/461

    2023

  15. [23]

    Henry Corrigan-Gibbs and Dan Boneh. 2017. Prio: Private, robust, and scalable computation of aggregate statistics. In14th USENIX symposium on networked systems design and implementation (NSDI 17). 259–282

    2017

  16. [24]

    Victor Costan and Srinivas Devadas. 2016. Intel SGX explained.Cryptology ePrint Archive(2016)

    2016

  17. [25]

    Katharine Daly, Hubert Eichner, Peter Kairouz, H Brendan McMahan, Daniel Ramage, and Zheng Xu. 2024. Federated learning in practice: reflections and pro- jections. In2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications ...

    2024

  18. [26]

    Research Scientist Daniel Ramage and Stefano Mazzocchi. 2020. Fed- erated Analytics: Collaborative Data Science without Data Collection. https://research.google/blog/federated-analytics-collaborative-data-science- without-data-collection/(2020)

    2020

  19. [27]

    2019.{FastKitten}: Practical smart contracts on bitcoin

    Poulami Das, Lisa Eckey, Tommaso Frassetto, David Gens, Kristina Hostáková, Patrick Jauernig, Sebastian Faust, and Ahmad-Reza Sadeghi. 2019.{FastKitten}: Practical smart contracts on bitcoin. In28th USENIX Security Symposium (USENIX Security 19). 801–818

    2019

  20. [28]

    Sergey Denisov, H Brendan McMahan, John Rush, Adam Smith, and Abhradeep Guha Thakurta. 2022. Improved differential privacy for sgd via optimal private linear operators on adaptive streams.Advances in Neural Information Processing Systems35 (2022), 5910–5924

    2022

  21. [29]

    Danny Dolev and Andrew Yao. 1983. On the security of public key protocols. IEEE Transactions on information theory29, 2 (1983), 198–208

    1983

  22. [30]

    John R Douceur. 2002. The sybil attack. InInternational workshop on peer-to-peer systems. Springer, 251–260

    2002

  23. [31]

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. 2006. Our data, ourselves: Privacy via distributed noise generation. In Advances in Cryptology-EUROCRYPT 2006: 24th Annual International Conference on the Theory and Applications of Cryptographi...

    2006

  24. [32]

    Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy.Foundations and Trends®in Theoretical Computer Science9, 3–4 (2014), 211–407

    2014

  25. [33]

    Hubert Eichner, Daniel Ramage, Kallista Bonawitz, Dzmitry Huba, Tiziano San- toro, Brett McLarnon, Timon Van Overveldt, Nova Fallen, Peter Kairouz, Al- bert Cheu, et al . 2024. Confidential federated computations.arXiv preprint arXiv:2404.10764(2024)

    2024 arXiv

  26. [34]

    Úlfar Erlingsson, Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. 2019. Amplification by shuffling: From local to central differential privacy via anonymity. InProceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms...

    2019

  27. [35]

    Russell A Fink, Alan T Sherman, Alexander O Mitchell, and David C Challener

  28. [36]

    Antonious Girgis, Deepesh Data, Suhas Diggavi, Peter Kairouz, and Ananda Theertha Suresh. 2021. Shuffled model of differential privacy in feder- ated learning. InInternational Conference on Artificial Intelligence and Statistics. PMLR, 2521–2529

    2021

  29. [37]

    Anonymization Team Google. 2019. Delta for thresholding.https: // github.com/ google/ differential-privacy/ blob/ main/ common_docs/ Delta_ For_Thresholding.pdf(2019)

    2019

  30. [38]

    Maurice P Herlihy and Jeannette M Wing. 1990. Linearizability: A correctness condition for concurrent objects.ACM Transactions on Programming Languages and Systems (TOPLAS)12, 3 (1990), 463–492

    1990

  31. [39]

    White House. 2012. Consumer data privacy in a networked world: A frame- work for protecting a privacy and promoting innovation in the globaeconom. http://www. whitphi) nse pnY/siles/default/files/privac(2012)

    2012

  32. [40]

    Heidi Howard, Fritz Alder, Edward Ashton, Amaury Chamayou, Sylvan Cleb- sch, Manuel Costa, Antoine Delignat-Lavaud, Cédric Fournet, Andrew Jeffery, Matthew Kerner, et al. 2023. Confidential consortium framework: Secure mul- tiparty applications with confidentiality, integrity,...

    2023 arXiv

  33. [41]

    Dzmitry Huba, John Nguyen, Kshitiz Malik, Ruiyu Zhu, Mike Rabbat, Ashkan Yousefpour, Carole-Jean Wu, Hongyuan Zhan, Pavel Ustinov, Harish Srinivas, et al. 2022. Papaya: Practical, private, and scalable federated learning.Proceedings of Machine Learning and Systems4 (2022), 814...

    2022

  34. [42]

    Mohit Kumar Jangid, Guoxing Chen, Yinqian Zhang, and Zhiqiang Lin. 2021. Towards formal verification of state continuity for enclave programs. In30th USENIX Security Symposium (USENIX Security 21). 573–590

    2021

  35. [43]

    An Ji, Bortik Bandyopadhyay, Congzheng Song, Natarajan Krishnaswami, Prabal Vashish, Rigel Smiroldo, Isabel Litton, Sayantan Mahinder, Mona Chitnis, and Andrew W Hill. 2025. Private Federated Learning In Real World Application–A Case Study.arXiv preprint arXiv:2502.04565(2025)

    2025 arXiv

  36. [44]

    Jiankai Jin, Chitchanok Chuengsatiansup, Toby Murray, Benjamin IP Rubinstein, Yuval Yarom, and Olga Ohrimenko. 2024. Elephants Do Not Forget: Differential Privacy with State Continuity for Privacy Budget. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Commu...

    2024

  37. [45]

    Peter Kairouz, Ziyu Liu, and Thomas Steinke. 2021. The distributed discrete gauss- ian mechanism for federated learning with secure aggregation. InInternational Conference on Machine Learning. PMLR, 5201–5212

    2021

  38. [46]

    Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. 2021. Practical and private (deep) learning without sampling or shuffling. InInternational Conference on Machine Learning. PMLR, 5213–5225

    2021

  39. [47]

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cor- mode, Rachel Cummings, et al. 2021. Advances and open problems in federated learning.Foundations and trends®in machine learning1...

    2021

  40. [48]

    Ryan Karl, Jonathan Takeshita, and Taeho Jung. 2021. Cryptonite: A framework for flexible time-series secure aggregation with non-interactive fault recovery. InSecurity and Privacy in Communication Networks: 17th EAI International Con- ference, SecureComm 2021, Virtual Event, ...

    2021

  41. [49]

    Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhod- nikova, and Adam Smith. 2011. What can we learn privately?SIAM J. Comput. 40, 3 (2011), 793–826

    2011

  42. [50]

    Fumiyuki Kato, Yang Cao, and Masatoshi Yoshikawa. 2023. Olive: Oblivious Federated Learning on Trusted Execution Environment against the Risk of Spar- sification.Proceedings of the VLDB Endowment16, 10 (2023), 2404–2417

    2023

  43. [51]

    Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, et al. 2020. Spectre attacks: Exploiting speculative execution.Commun. ACM63, 7 (2020), 93–101

    2020

  44. [52]

    Hanjun Li, Huijia Lin, Antigoni Polychroniadou, and Stefano Tessaro. 2023. LERNA: secure single-server aggregation via key-homomorphic masking. In International Conference on the Theory and Application of Cryptology and Infor- mation Security. Springer, 302–334

    2023

  45. [53]

    Jinyuan Li, Maxwell N Krohn, David Mazieres, and Dennis E Shasha. 2004. Secure Untrusted Data Repository (SUNDR).. InOsdi, Vol. 4. 9–9

    2004

  46. [54]

    Yehuda Lindell. 2017. How to simulate it–a tutorial on the simulation proof technique.Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich(2017), 277–346

    2017

  47. [55]

    Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, et al

  48. [56]

    Yiping Ma, Jess Woods, Sebastian Angel, Antigoni Polychroniadou, and Tal Rabin

  49. [57]

    2017.{ROTE}: Rollback protection for trusted execution

    Sinisa Matetic, Mansoor Ahmed, Kari Kostiainen, Aritra Dhar, David Sommer, Arthur Gervais, Ari Juels, and Srdjan Capkun. 2017.{ROTE}: Rollback protection for trusted execution. In26th USENIX Security Symposium (USENIX Security 17). 1289–1306

    2017

  50. [58]

    David Mazieres and Dennis Shasha. 2002. Building secure file systems out of Byzantine storage. InProceedings of the twenty-first annual symposium on Principles of distributed computing. 108–117

    2002

  51. [59]

    H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. 2018. Learn- ing Differentially Private Recurrent Language Models. InInternational Conference on Learning Representations

    2018

  52. [60]

    H Brendan McMahan, Zheng Xu, and Yanxiang Zhang. 2024. A Hassle-free Algorithm for Private Learning in Practice: Don’t Use Tree Aggregation, Use BLTs.arXiv preprint arXiv:2408.08868(2024)

    2024 arXiv

  53. [61]

    Simon Meier, Benedikt Schmidt, Cas Cremers, and David Basin. 2013. The TAMARIN prover for the symbolic analysis of security protocols. InComputer Aided Verification: 25th International Conference, CA V 2013, Saint Petersburg, Russia, July 13-19, 2013. Proceedings 25. Springer, 696–701

    2013

  54. [62]

    Fan Mo, Hamed Haddadi, Kleomenis Katevas, Eduard Marin, Diego Perino, and Nicolas Kourtellis. 2021. PPFL: Privacy-preserving federated learning with trusted execution environments. InProceedings of the 19th annual international conference on mobile systems, applications, and s...

    2021

  55. [63]

    Kit Murdock, David Oswald, Flavio D Garcia, Jo Van Bulck, Daniel Gruss, and Frank Piessens. 2020. Plundervolt: Software-based fault injection attacks against Intel SGX. In2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1466–1482

    2020

  56. [64]

    Satoshi Nakamoto. 2008. Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf(2008)

    2008

  57. [65]

    John Nguyen, Kshitiz Malik, Hongyuan Zhan, Ashkan Yousefpour, Mike Rabbat, Mani Malek, and Dzmitry Huba. 2022. Federated learning with buffered asyn- chronous aggregation. InInternational conference on artificial intelligence and statistics. PMLR, 3581–3607

    2022

  58. [66]

    Jianyu Niu, Wei Peng, Xiaokuan Zhang, and Yinqian Zhang. 2022. Narrator: Secure and practical state continuity for trusted execution in the cloud. InPro- ceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2385–2399

    2022

  59. [67]

    Maxence Noble, Aurélien Bellet, and Aymeric Dieuleveut. 2022. Differentially private federated learning on heterogeneous data. InInternational Conference on Artificial Intelligence and Statistics. PMLR, 10110–10145

    2022

  60. [68]

    Trusted

    Bryan Parno. 2008. Bootstrapping Trust in a" Trusted" Platform.. InHotSec

    2008

  61. [69]

    Bryan Parno, Jacob R Lorch, John R Douceur, James Mickens, and Jonathan M McCune. 2011. Memoir: Practical state continuity for protected modules. In2011 IEEE Symposium on Security and Privacy. IEEE, 379–394

    2011

  62. [70]

    Rafael Pass, Elaine Shi, and Florian Tramer. 2017. Formal abstractions for attested execution secure processors. InAdvances in Cryptology–EUROCRYPT 2017: 36th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Paris, France, April 30–Ma...

    2017

  63. [71]

    Frank Piessens and Paul C van Oorschot. 2024. Side-channel attacks: A short tour.IEEE Security & Privacy22, 2 (2024), 75–80

    2024

  64. [72]

    Mark Russinovich. 2023. Confidential computing: Elevating cloud security and privacy.Commun. ACM67, 1 (2023), 52–53

    2023

  65. [73]

    Jinhyun So, Başak Güler, and A Salman Avestimehr. 2021. Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning.IEEE Journal on Selected Areas in Information Theory2, 1 (2021), 479–489

    2021

  66. [74]

    Harish Srinivas, Graham Cormode, Mehrdad Honarkhah, Samuel Lurye, Jonathan Hehir, Lunwen He, George Hong, Ahmed Magdy, Dzmitry Huba, Kaikai Wang, et al. 2024. Federated Analytics in Practice: Engineering for Privacy, Scalability and Practicality.arXiv preprint arXiv:2412.02340(2024)

    2024 arXiv

  67. [75]

    Raoul Strackx and Frank Piessens. 2016. Ariadne: A minimal approach to state continuity. In25th USENIX Security Symposium (USENIX Security 16). 875–892

    2016

  68. [76]

    Kunal Talwar, Shan Wang, Audra McMillan, Vitaly Feldman, Pansy Bansal, Bailey Basile, Aine Cahill, Yi Sheng Chan, Mike Chatzidakis, Junye Chen, et al. 2024. Samplable anonymous aggregation for private federated data analysis. InProceed- ings of the 2024 on ACM SIGSAC Conferenc...

    2024

  69. [77]

    Salil Vadhan. 2017. The complexity of differential privacy.Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich(2017), 347–450

    2017

  70. [78]

    Salil Vadhan and Tianhao Wang. 2021. Concurrent composition of differential privacy. InTheory of Cryptography: 19th International Conference, TCC 2021, Raleigh, NC, USA, November 8–11, 2021, Proceedings, Part II 19. Springer, 582–604

    2021

  71. [79]

    Salil Vadhan and Wanrong Zhang. 2023. Concurrent composition theorems for differential privacy. InProceedings of the 55th Annual ACM Symposium on Theory of Computing. 507–519

    2023

  72. [80]

    Stephan van Schaik, Marina Minkin, Daniel Genkin, Yuval Yarom, and Andrew Kwong. 2021. CacheOut and SGAxe: How SGX Fails in Practice. Video at https://youtu.be/kO-3Uh7tq60?t=1806

    2021

  73. [81]

    Weili Wang, Sen Deng, Jianyu Niu, Michael K Reiter, and Yinqian Zhang. 2022. Engraft: Enclave-guarded raft on byzantine faulty nodes. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2841– 2855

    2022

  74. [82]

    Annika Wilde, Tim Niklas Gruel, Claudio Soriente, and Ghassan Karame. 2024. The Forking Way: When TEEs Meet Consensus.arXiv preprint arXiv:2412.00706 (2024)

    2024 arXiv

  75. [83]

    Yuanzhong Xu, Weidong Cui, and Marcus Peinado. 2015. Controlled-channel attacks: Deterministic side channels for untrusted operating systems. In2015 IEEE Symposium on Security and Privacy. IEEE, 640–656

    2015

  76. [84]

    Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher Choquette, Peter Kairouz, Brendan Mcmahan, Jesse Rosenstock, and Yuanbo Zhang. 2023. Feder- ated Learning of Gboard Language Models with Differential Privacy. InProceed- ings of the 61st Annual Meeting of the Association for ...

    2023 doi

  77. [85]

    Xinying Yang, Yuan Zhang, Sheng Wang, Benquan Yu, Feifei Li, Yize Li, and Wenyuan Yan. 2020. LedgerDB: A centralized ledger database for universal audit and verification.Proceedings of the VLDB Endowment13, 12 (2020), 3138–3151

    2020

  78. [86]

    Cong Yue, Gang Chen, Tien Tuan Anh Dinh, Beng Chin Ooi, Zhongle Xie, Xiaokui Xiao, and Meihui Zhang. 2023. GlassDB: An Efficient Verifiable Ledger Database System Through Transparency.Proceedings of the VLDB Endowment16, 6 (2023), 1359–1371

    2023

  79. [87]

    add the delta

    Yuanbo Zhang, Daniel Ramage, Zheng Xu, Yanxiang Zhang, Shumin Zhai, and Peter Kairouz. 2023. Private Federated Learning in Gboard.arXiv e-prints(2023), arXiv–2306. Takagi et al. A Discussions In this section, we explore the vulnerabilities of our approach, dis- cuss practical ...

    2023

  80. [91]

    Ecall: EC_Initialization()

  81. [92]

    Ocall: OC_AuditorSignForInitialization(quote)

  82. [93]

    Return Signatures (Approval)

  83. [94]

    Return the genesis block of the evidence chain

  84. [95]

    Ecall: EC_InitProcess(evidence_chain, input)

  85. [96]

    Ocall: OC_AuditorSign(quote)

  86. [97]

    Return Signature (Approval)

  87. [98]

    3Ex nonce_for_init block_hash input # t1 # t2 . 4UpdateLabel (... , block_hash , input ) @t1 5& 6UpdateLabel (... , block_hash , input ) @t2 7& 8# t1 < # t2 9

    Return the new block of the evidence chain Figure 6: Sequence diagram of the state transition protocol between the Server, Planner Enclave, and Auditors. hash, the new input. This new block is then appended to the evidence chain, completing the state transition. This detailed ...

  88. [2011]

    InTrust and Trustworthy Computing: 4th International Conference, TRUST 2011, Pittsburgh, PA, USA, June 22-24, 2011

    Catching the Cuckoo: Verifying TPM Proximity Using a Quote Timing Side- Channel: (Short Paper). InTrust and Trustworthy Computing: 4th International Conference, TRUST 2011, Pittsburgh, PA, USA, June 22-24, 2011. Proceedings 4. Springer, 294–301

    2011

  89. [2020]

    ACM63, 6 (2020), 46–56

    Meltdown: Reading kernel memory from user space.Commun. ACM63, 6 (2020), 46–56

    2020

  90. [2023]

    In2023 IEEE Symposium on Security and Privacy (SP)

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 477–496

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.