Summary
In federated learning, where multiple organizations train AI models together without sharing their private data, some participants might try to cheat by tampering with the model to learn others' data. The authors study a way for the central server to catch these cheating attempts by sending secret test data and asking clients to send back a special kind of checksum based on model updates. This checksum is designed to tolerate small differences due to computers working slightly differently and reliably spots cheating clients without false alarms. However, if attackers keep their tampering separate from the tested computations, this method can't catch them, so it works best combined with other privacy protections.
Abstract
Inside a federated learning system a participant can quietly study the shared model and learn about others' private data. The usual defense, differential privacy, often adds so much noise that the model is no longer worth training. In cross-silo FL, where participants are a few accountable organizations and the server is trusted, we ask whether the server can instead interrogate clients. Each round it sends a secret challenge batch and asks every client to return a checksum of the gradient that batch induces, together with a timing. A client that mutated the model state, as an active generative-adversarial-network discriminator attacker does, returns a wrong checksum. We make this checksum robust to benign cross-platform floating-point non-determinism with a quantized fingerprint compared under a small tolerance. It flags two distinct active attacks at a true-positive rate of $1.0$ with no false positives on the checksum axis, stable across the fingerprint's parameters and up to $50$ clients at malicious ratios to $40\%$, for $32\,\mathrm{ms}$ of server work and $4.35\,\mathrm{kB}$ per response. Against a purely passive attacker the only signal is timing, and it is not robust: a cohort-relative test detects only in low-jitter conditions while a false-positive-free per-client baseline is blind, so no configuration delivers both. An attacker that answers the challenge on an untouched copy of the model while tampering with a replica evades the audit entirely. Therefore the checksum is a reliable in-band signal against attackers that do not decouple the audited computation from the attacked one, and it composes with differential privacy, whose accuracy cost we quantify on Texas100, rather than replacing it.