Optimistic verification improves federated learning security and speed
OPFL: Optimistic Verification of Federated Learning via Empirical Boundary
Cryptography and SecurityArtificial Intelligence
Summary
Federated learning lets many users train AI models together without sharing private data, but it’s hard to check if everyone is following the rules or cheating. The authors developed OPFL, a way to verify training steps privately using secure calculations that hide data. They notice small, stable differences in calculations done locally versus securely and use this to spot bad updates without false alarms. OPFL audits only a few steps to speed up verification while keeping models safe from attacks.
What this means in practice
- •For federated learning engineers: Verify client model updates privately with less computational cost, enabling faster detection of tampered contributions during training.
- •For cloud security teams: Implement robust client verification in multi-tenant learning setups to prevent poisoned models without revealing sensitive training data.
Authors
Hongxu Su, Jianzhu Yao, Xuechao Wang, Pramod Viswanath
Abstract
Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving $0$\% ASR against model poisoning and PGD-based attacks. On a LeNet workload, at $p=0.01$, OPFL is approximately $98.6\times$ faster than full MPC-based FL and $625.5\times$ faster than ZK-based approach.