Federated learning made robust and publicly verifiable for multiple users
End-to-End Verifiable and Robust Federated Learning
Machine Learning
Summary
Federated learning lets many people train a shared computer model without sharing their private data, but this can be risky if some users send bad data or the system can’t be trusted. The authors designed a method that not only excludes harmful or unusual updates automatically but also lets anyone check the results without seeing anyone’s private data. They use special math-based proofs to confirm the process is honest and secure. Their tests show the method keeps accuracy high and the checking process is fast enough to be practical.
What this means in practice
- •For enterprise it teams: Ensure federated learning deployments can exclude malicious client data and verify aggregations without revealing sensitive inputs.
- •For cloud service providers: Offer federated learning services with built-in verifiable robustness to attract customers needing privacy and trust guarantees.$Commercial implications: Enables selling robust federated learning platforms that assure clients their data and model updates remain confidential and trustworthy.
Authors
Doryan Lesaignoux, Enrique Mármol Campos, Gabriele Spini, José L. Hernández-Ramos, Stephan Krenn
Abstract
Federated learning enables multiple parties to train a shared model without centralizing raw data with the help of an aggregator, but introduces integrity risks once participants or infrastructure are not fully trustworthy. Two requirements are particularly important: robustness to poisoned or Byzantine client updates, and verifiability of the aggregator so that clients or third parties can audit the reported aggregation without learning individual updates. Existing work has largely treated these goals separately, and efficient public verifiability for robust, outlier-excluding aggregation remains limited. We present a verifiable federated learning protocol that makes a robust aggregation pipeline publicly auditable. Our design combines cryptographic commitments with non-interactive zero-knowledge proofs to certify both (i) cosine-similarity-based outlier exclusion and (ii) aggregation over the selected set, without revealing individual client updates to verifiers. In experiments under representative poisoning attacks, our method maintains high accuracy, with an average accuracy loss below 4\% across the evaluated configurations, while keeping verification overhead practical: proof artifacts can be generated and verified within minutes at the scale studied. In summary, our results show that robust outlier exclusion and public verifiability can be jointly achieved in a federated learning setting.