Jul 2026· Proceedings on Privacy Enhancing Technologies· 0 citations
TL;DR
VeriDP is presented, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge, uniting differential privacy and verifiable computation for secure and auditable ML.
Abstract
Stochastic Gradient Descent (SGD) is the foundation of modern machine learning (ML). In privacy-sensitive settings, gradients can reveal details about individual data points. Differential Privacy (DP) protects sensitive data during ML training by clipping gradients and adding calibrated Gaussian noise. However, existing frameworks assume semi-honest participants, which fails in adversarial or federated environments where malicious actors can bypass or alter the noise addition process, breaking privacy guarantees. We present VeriDP, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge. VeriDP integrates Zero-Knowledge Proofs (ZKPs) with polynomial commitments, sumcheck and GKR-based proofs, and incrementally verifiable computation (IVC) to generate compact proofs of correct gradient computation, clipping, averaging, and Gaussian noise generation—without revealing private data or randomness. Unlike previous systems that only verify the final privacy budget, VeriDP enables per-iteration verifiability of each model update, providing strong privacy assurances even in adversarial settings. This establishes a novel and complete Zero-Knowledge Proof of Differentially Private Stochastic Gradient Descent (ZK-DPSGD), uniting differential privacy and verifiable computation for secure and auditable ML. Our evaluation shows that prover time increases linearly with the number of input samples, while both verifier time (2–5 ms) and proof size (3–4 KB) remain compact and effectively constant.
Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Harsh Kasyap, Anil Kumar Pradhan, U. Atmaca et al.· 0 citations
Distributed machine learning enables collaborative model training without centralizing data, but it also exposes learning processes to privacy leakage and malicious manipulation. Existing defenses typically address these threats in isolation and are often tailored to specific learning paradigms or model architectures, limiting their applicability in realistic deployments. In particular, federated learning and decentralized learning exhibit distinct adversarial surfaces that are rarely addressed within a unified framework. In this paper, we present a model-agnostic framework for adversary-resistant distributed learning that jointly addresses privacy preservation and malicious behavior across both federated and decentralized settings. Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique applicable to arbitrary machine learning models. For federated learning, we integrate robust aggregation strategies to mitigate the impact of malicious participants, while for decentralized learning we employ approximate decode-and-compare and group testing techniques to enable lightweight verification and adversary isolation without relying on a trusted aggregator. Crucially, we evaluate the proposed framework through an explicit, attack-driven analysis. We implement representative privacy attacks and malicious behaviors, and empirically demonstrate that the combination of GPBACC with robust aggregation and verification mechanisms significantly reduces privacy leakage and improves resilience against active adversaries. These results suggest that privacy-enhancing coded computing, when combined with appropriate adversary-resistance strategies, provides a practical and deployable foundation for secure distributed machine learning.
Xavier Martínez-Luaña, Alba Gude-Santos, Manuel Fernández-Veiga et al.· 0 citations
The adoption of federated learning (FL) has been on the rise in recent years due to the decentralized approach to data handling. Vertical federated learning is a type of FL that allows different parties to train shared models on complementary feature spaces without the direct exchange of data. However, the gradients these parties exchange can inadvertently carry sensitive information. Adversaries exploit this leakage to mount label inference attacks (LIAs) and adversarial attacks. To curb this, defense mechanisms have been deployed, but most of them either trade robustness for privacy and model utility or vice versa. This study addresses this gap by introducing an improved defense mechanism that combines adversarial training (to harden the model against adversarial perturbations) and differential-privacy-style noise injection (aimed at restoring the label privacy weakened by adversarial training) to collectively enhance the robustness of the existing KDk defense mechanism with marginal model utility trade-off. Instead of relying on heavy encryption or post-processing techniques, it builds privacy directly into the learning dynamics of the model. It was evaluated using five publicly available datasets spanning three data modalities with the proposed mechanism achieving competitive near-baseline accuracy while significantly reducing label-inference success. Under FGSM-based adversarial evaluation, the robustness gap of this mechanism was found to be approximately 1% compared to the 36% robustness gap of the existing KDk mechanism. The Privacy Leakage Index (PLI) reached 81.32%, 96.08%, 82.41%, 86.68% and 73.88% for CIFAR-10, CIFAR-100, CINIC-10, Yahoo! Answers and Criteo datasets, respectively. The results suggest that robustness and privacy security objectives can coexist to secure VFL with minimal effect on model accuracy.
N. Azeez, Oluwatobi Sunday Malomo, Omotolani Mary Okerinde et al.· Informatics· 0 citations
To address privacy leakage from user images, intermediate representations, and outputs during Vision Transformer (ViT) inference in distributed edge services, this paper presents SViT, a two-server secret-sharing framework with offline correlated randomness. The revised design specifies fixed-point arithmetic over the ring Z_(2^64) with 16 fractional bits, fresh one-time masks, probabilistic truncation, numerical ranges, and complete input-output procedures for SExp, SDiv, SSqrt, SVar, SLayerNorm, SSoftmax, and SGeLU. The protocols use fixed-depth range reduction, lookup-assisted initialization, and a constant number of Newton updates, so their online depth is independent of numerical convergence tolerances. Under the semi-honest, non-colluding-server model, the revised security analysis defines approximate ideal functionalities, public leakage, simulator inputs, and sequential composition. Existing microbenchmarks show 2.28-6.50 times lower runtime and 4.00-14.20 times lower online communication than CrypTen for the reported core operators; for SDiv, runtime decreases from 9.1 ms to 1.4 ms and communication from 10.8337 MB to 0.7629 MB. Synthetic Q16 numerical checks report maximum absolute errors of 5.10×10−5 for SExp and 4.73×10−4 for SGeLU, maximum relative errors of 1.27×10−5 for reciprocal and 3.72×10−5 for square root, and 100% top-1 consistency over 10,000 randomly generated Softmax vectors. The reported end-to-end result remains 3799.744 ms and 2.85 GB per inference; therefore, SViT is described as communication-reduced relative to the evaluated MPC baselines rather than universally lightweight, and its present practical scope is primarily high-bandwidth LAN or provider-edge deployments.
Tingting Chen· ICST Transactions on Scalabl...· 0 citations
Model updates in federated learning can expose sensitive information, while existing defenses often trade off privacy protection, communication efficiency, and training stability. This paper presents SURGE, which stands for Sparse Updates with Randomized Guarding and Selective Encryption. SURGE targets empirical attack resistance under the honest-but-curious server model, rather than a formal privacy guarantee. SURGE builds a unified sparse coordinate set from Top-k accumulated updates and uses Layered Risk-guided Mask Selection (LRMS) to allocate a limited homomorphic-encryption budget according to leakage risk, plaintext exposure history, and residual cost. It then applies random sign flipping to the remaining plaintext coordinates and uses residual feedback to compensate for sparsification and perturbation errors across rounds. Experiments cover IID and label-skew non-IID partitions on MNIST and CIFAR-10, as well as a natural-split FEMNIST benchmark. On MNIST and CIFAR-10, SURGE reduces communication overhead by 87% to 88% relative to FedPHE and MaskCrypt, averaged over the two datasets and the two selective-encryption baselines, and reaches high accuracy sooner under the same simulated wall-clock budget. SURGE also drives membership inference performance close to random guessing and substantially degrades the quality of gradient inversion reconstructions.
Federated learning (FL) protects client data by sharing only model updates, yet current defences ignore timing metadata. We show that a single malicious client can embed a 128 bit cryptographic key into the final global model by modulating update latency alone, bypassing gradient-value inspections, differential privacy (DP), and secure aggregation (SecAgg). We model the latency-to-weight channel as an additive white Gaussian noise (AWGN) process with CPU jitter and derive its information-theoretic capacity, demonstrating that 134 rounds suffice to transmit 128 bits at ε=500 μs. We design Jitter Deconv, a spread-spectrum encoder/decoder that maps Gold-code delays to weight-space imprints and recovers keys with bit-error rate (BER) 1.02×10⁻³ under DP-SGD (σ=10⁻²) and SecAgg. To detect the covert channel, we introduce Latency Print, a lightweight autocovariance-based statistic achieving AUC=0.98 and ≤0.7 % false-positive rate with <0.1 % CPU overhead. Experiments on CIFAR-10, FEMNIST, and Stack Overflow under realistic FL hyperparameters and hardware time-stamping (PTP, ±1 μs) confirm that our attack incurs ≤0.18 % accuracy degradation and survives network congestion. We further compare Latency Print to an SVM-based arrival-pattern classifier, demonstrating superior detection speed and reliability. Our findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.
Barakat Saad Ibrahim, Ahmed Hameed Shakir, Hasan Jameel· Al-Noor Journal of Engineeri...· 0 citations