ClusterGuard: Secure Clustered Aggregation for Federated Learning with Robustness

For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">secure aggregation</i> . However, secure aggregation makes model poisoning attacks such as backdooring more convenient given that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes a new federated learning technique SAFE-Learning to support backdoor detection for secure aggregation. We achieve this through two new primitives - <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">oblivious random grouping (ORG)</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">partial parameter disclosure (PPD)</i> . ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. ORG is based on our construction of several new primitives including tree-based random subgroup generation, oblivious secure aggregation, and randomized Diffie-Hellman key exchange. ORG can thwart colluding attackers from knowing each other’s group membership assignment with non-negligible advantage than random guess. Backdoor attacks are detected based on statistical distributions of the subgroup aggregated parameters of the learning iterations. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.

In light of the emergence of privacy breaches in federated learning, secure aggregation protocols, which mainly adopt either homomorphic encryption or threshold secret sharing techniques, have been extensively developed to preserve the privacy of each client's local gradient. Nevertheless, many existing schemes suffer from either poor capability of privacy protection or expensive computational and communication overheads. Accordingly, in this paper, we propose an efficient and multi-private key secure aggregation scheme for federated learning. Specifically, we skillfully design a multi-private key secure aggregation algorithm that achieves homomorphic addition operation, with two important benefits: 1) both the server and each client can freely select public and private keys without introducing a trusted third party, and 2) the plaintext space is relatively large, making it more suitable for deep models. Besides, for dealing with the high dimensional deep model parameter, we introduce a super-increasing sequence to compress multi-dimensional data into one dimension, which greatly reduces encryption and decryption times as well as communication for ciphertext transmission. Detailed security analyses show that our proposed scheme can achieve semantic security of both individual local gradients and the aggregated result while achieving optimal robustness in tolerating client collusion. Extensive simulations demonstrate that the accuracy of our scheme is almost the same as the non-private approach, while the efficiency of our scheme is much better than the state-of-the-art baselines. More importantly, the efficiency advantages of our scheme will become increasingly prominent as the number of model parameters increases.

Sensor applications often leverage in-network aggregation to extract aggregates, such as predicate count and average, from the network. With in-network aggregation, a malicious sensor can easily manipulate the intermediate aggregation results and corrupt the final answer. Most existing secure aggregation schemes aim to defend against stealth attacks and can only raise an alarm when the final answer is corrupted, without being able to pinpoint and revoke the malicious sensors. While some recent protocols can pinpoint and revoke malicious sensors, they need to rely on expensive public key cryptography to be robust against certain attacks. Using only symmetric key cryptography, this paper aims to strictly diminish the capability of adversaries whenever they launch a successful attack, so that malicious sensors can only ruin the aggregation result for a small number of times before they are fully revoked. To this end, we propose VMAT (verifiable minimum with audit trail), a novel secure aggregation protocol with malicious sensor revocation capability. VMAT relies on symmetric key cryptography only, and provides provable guarantees that each execution can either produce the correct aggregation result efficiently, or revoke some key held by the adversary.

This article provides a comprehensive survey of aggregation strategies in federated learning (FL). This decentralized machine learning (ML) paradigm enables multiple clients to collaboratively train models without sharing their local datasets. Aggregation is a pivotal aspect of FL, as it integrates model updates from diverse clients into a unified global model while addressing critical challenges such as data heterogeneity, scalability, and privacy preservation. The study categorizes aggregation strategies into three primary approaches: data-centric, model-centric, and secure aggregation, each tailored to address distinct problems in FL systems. Data-centric strategies focus on addressing non-independent and identically distributed (non-IID) data across clients, ensuring that model updates account for imbalances in data distributions. Model-centric strategies optimize the aggregation of model parameters, emphasizing techniques such as weighted averaging and model distillation to improve model performance across clients with diverse data characteristics. Secure aggregation techniques aim to enhance privacy and robustness, protecting client data from potential adversarial threats through encryption-based methods like secure multi-party computation (SMPC) and Byzantine-resilient techniques. The analysis delves into the advantages and limitations of these aggregation strategies, particularly their role in tackling challenges like non-IID data, communication efficiency, and resistance to adversarial attacks. Furthermore, the article identifies existing research gaps in FL, including the need for more scalable and robust aggregation methods capable of reducing communication costs, enhancing privacy guarantees, and improving performance in highly heterogeneous environments. These insights provide a roadmap for future research aimed at advancing aggregation strategies in FL to improve model accuracy, security, and efficiency in real-world applications.

Federated learning enables users to collaboratively train a machine learning model over their private datasets. Secure aggregation protocols are employed to mitigate information leakage about the local datasets from user-submitted model updates. This setup, however, still leaks the user participation in training, which can also be sensitive. Protecting user anonymity is even more challenging in dynamic environments where users may (re)join or leave the training process at any point of time. This paper introduces AnoFel, the first framework to support private and anonymous dynamic participation in federated learning (FL). AnoFel leverages several cryptographic primitives, the concept of anonymity sets, differential privacy, and a public bulletin board to support anonymous user registration, as well as unlinkable and confidential model update submission. Our system allows dynamic participation, where users can join or leave at any time without needing any recovery protocol or interaction. To assess security, we formalize a notion for privacy and anonymity in FL, and formally prove that AnoFel satisfies this notion. To the best of our knowledge, our system is the first solution with provable anonymity guarantees. To assess efficiency, we provide a concrete implementation of AnoFel, and conduct experiments showing its ability to support learning applications scaling to a large number of clients. For a TinyImageNet classification task with 512 clients, the client setup to join is less than 3 sec, and the client runtime for each training iteration takes a total of 8 sec, where the added overhead of AnoFel is 46% of the total runtime. We also compare our system with prior work and demonstrate its practicality. AnoFel client runtime is up to 5x faster than Truex et al., despite the added anonymity guarantee and dynamic user joining in AnoFel. Compared to Bonawitz et al., AnoFel is only 2x slower for added support for privacy in output, dynamic user joining, and anonymity.

Secure aggregation is the distributed task of securely computing a sum of values (or a vector of values) held by a set of parties, revealing only the output (i.e., the sum) in the computation. Existing protocols, such as Prio (NDSI’17), Prio+ (SCN’22), Elsa (S&amp;P’23), and Whisper (S&amp;P’24), support secure aggregation with input validation to ensure inputs belong to a specified domain. However, when malicious servers are present, these protocols primarily guarantee privacy but not input validity. Also, malicious server(s) can cause the protocol to abort. We introduce SCIF, a novel multi-server secure aggregation protocol with input validation, that remains secure even in the presence of malicious actors, provided fewer than one-third of the servers are malicious. Our protocol overcomes previous limitations by providing two key properties: (1) guaranteed output delivery, ensuring malicious parties cannot prevent the protocol from completing, and (2) guaranteed input inclusion, ensuring no malicious party can prevent an honest party’s input from being included in the computation. Together, these guarantees provide strong resilience against denial-of-service attacks. Moreover, SCIF offers these guarantees without increasing client costs over Prio and keeps server costs moderate. We present a robust end-to-end implementation of SCIF and demonstrate the ease with which it can be instrumented by integrating it in a simulated Tor network for privacy-preserving measurement.

Vehicular Ad Hoc Networks (VANETs) are an essential part of Intelligent Transportation Systems as they provide real-time interaction between vehicles and roadside infrastructure but face significant problems like privacy leakage, sluggishness, and dynamic network structure. Current solutions are mostly centralized, and thus, there is a high probability of sensitive data being exposed, or reactive, and therefore, do not have the ability to make proactive and predictive decisions. In the quest to address these shortcomings, the present paper proposes a new framework, referred to as Federated Digital Twin Edge Intelligence with Graph Neural Networks (Fed-DT-EdgeGNN), a combination of Digital Twin-based simulation to model realistic traffic and attack scenarios, spatio-temporal Graph Neural Networks to model intricate vehicular interactions, and Federated Learning between K = 10 RSUs to allow In order to have a strong privacy protection, Differential Privacy-based Stochastic Gradient Descent (DP-SGD) is used with the following parameters: ε = 1.0, δ = 10 -5, clipping norm C = 1.0, and noise multiplier σ = 0.5, and there will be no sensitive information leakage during model updates. The framework is tested with T = 50 rounds of communication and 5 local training steps with a learning rate of 2 x 10 -5 and attains an accuracy of 95.2%, precision of 94.6%, recall of 95.8%, and F1-score of 95.1%, and has good performance when the traffic is non-IID. The given solution provides the scalable, secure, and predictive solution of future generation vehicular communication systems, which allows to manage the traffic effectively and trust the smart transportation environment.

Federated Learning (FL) allows several data owners to train a joint model without sharing their training data. Such a paradigm is useful for better privacy in many ubiquitous computing systems. However, FL is vulnerable to poisoning attacks, where malicious participants attempt to inject a backdoor task in the model at training time, along with the main task that the model was initially trained for. Recent works show that FL is particularly vulnerable to edge-case backdoors introduced by data points with unusual out-of-distribution features. Such attacks are among the most difficult to counter, and today's FL defense mechanisms usually fail to tackle them. In this paper, we present ARMOR, a defense mechanism that leverages adversarial learning to uncover edge-case backdoors. In contrast to most of existing FL defenses, ARMOR does not require real data samples and is compatible with secure aggregation, thus, providing better FL privacy protection. ARMOR relies on GANs (Generative Adversarial Networks) to extract data features from model updates, and uses the generated samples to test the activation of potential edge-case backdoors in the model. Our experimental evaluations with three widely used datasets and neural networks show that ARMOR can tackle edge-case backdoors with 95% resilience against attacks, and without hurting model quality.

Healthcare data holds immense potential to improve diagnostics and treatment, but centralized collection risks patient privacy and suffers from limited labeled samples. Existing methods fall short in securely leveraging distributed data while reducing annotation costs. To address this, we propose FTAL ‐ QNC —a novel Federated Transfer Active Learning framework with Quantized Neural Cryptography—that enables privacy‐preserving, communication‐efficient, and label‐efficient collaborative model training. FTAL ‐ QNC integrates four core components in a unified architecture: (1) Federated learning for decentralized model training without data sharing, (2) Transfer learning to handle data heterogeneity across hospitals, (3) Active learning to minimize manual labeling by prioritizing informative samples, and (4) Quantized neural cryptography to ensure secure, low‐overhead exchange of encrypted model updates. Empirical evaluations on real‐world datasets, including Lung CT and ChestX ‐ray14, demonstrate that FTAL ‐ QNC enhances segmentation and classification accuracy to 97.3% and 97.0% recall for Lung CT , respectively, while significantly reducing annotation effort compared to standard federated learning and other sampling methods. Our contributions include a privacy‐preserving and communication‐efficient collaborative framework, an integrated active learning mechanism for efficient data labeling, and a secure aggregation protocol via quantized neural cryptography. These results demonstrate FTAL ‐ QNC 's potential to advance safe, collaborative medical research and improve patient outcomes.

HSIs are widely employed in practical applications such as environmental monitoring, agriculture, military reconnaissance, and geographic mapping. Although Federated Learning (FL) allows decentralized model training without sharing raw data, transmitting model updates may still leak sensitive information. To address this issue, we proposed ADP-SSL (Adaptive Differentially Private Secure Socket Layer), a privacy-preserving FL framework that combines adaptive differential privacy with SSL-based communication. This design ensures secure transmission of model updates while reducing computational and communication overhead relative to traditional cryptographic techniques. Furthermore, to address the challenges posed by non-independent and identically distributed (non-IID) data across clients, we introduce FedEL (Federated Ensemble Learning). We evaluate the proposed approach on standard HSI datasets, including Indian Pines, Pavia University, and Barley. Experimental results show that ADP-SSL effectively mitigates privacy risks with minimal performance degradation, while FedEL improves classification accuracy in non-IID settings. Together, these methods offer a scalable and secure solution for real-world, distributed HSI classification.

Our research introduces a framework that integrates edge computing, quantum transfer learning, and federated learning to revolutionize pain level assessment through ECG signal analysis. The primary focus lies in developing a robust, privacy-preserving system that accurately classifies pain levels (low, medium, and high) by leveraging the intricate relationship between pain perception and autonomic nervous system responses captured in ECG signals. At the heart of our methodology lies a signal processing approach that transforms one-dimensional ECG signals into rich, two-dimensional Continuous Wavelet Transform (CWT) images. These transformations capture both temporal and frequency characteristics of pain-induced cardiac variations, providing a comprehensive representation of autonomic nervous system responses to different pain intensities. Our framework processes these CWT images through a sophisticated quantum-classical hybrid architecture, where edge devices perform initial preprocessing and feature extraction while maintaining data privacy. The cornerstone of our system is a Quantum Convolutional Hybrid Neural Network (QCHNN) that harnesses quantum entanglement properties to enhance feature detection and classification robustness. This quantum-enhanced approach is seamlessly integrated into a federated learning framework, allowing distributed training across multiple healthcare facilities while preserving patient privacy through secure aggregation protocols. The QCHNN demonstrated remarkable performance, achieving a classification accuracy of 94.8% in pain level assessment, significantly outperforming traditional machine learning approaches.

Federated Learning (FL) has become one of the paradigms shifting towards machine learning, allowing a number of edge devices to jointly train models without exchanging raw data. This can be used to guarantee privacy of the data, less data communication overhead, and real-time decision-making under edge computing conditions. The paper discusses federated learning to secure edge computing, focusing on architecture, communication models, aggregation, and security. The experimental and theoretical studies show that FL is capable of reaching model accuracy that is similar to the centralized learning and reducing privacy threats and adversarial risks. The problems, including the heterogeneity of data, and the lack of computing power and communication efficiency, are discussed critically. The research paper ends with the suggestions on how to improve FL implementation in the actual edge networks, focusing on secure aggregation protocols, differential privacy, and client selection adaption strategies.

Federated learning (FL) provides a decentralized approach to artificial intelligence (AI) model training, enabling multiple devices or systems to collaboratively train models without sharing raw data. The core challenge lies in maintaining data privacy, security, and the overall efficiency of model convergence across distributed networks. This paper proposes a novel framework for secure federated learning that utilizes advanced encryption techniques, secure aggregation protocols, and differential privacy mechanisms to enhance both privacy and model accuracy. Experimental results from a real-world use case demonstrate the efficiency of this framework, with the proposed model outperforming existing solutions in terms of model convergence speed and privacy protection. The findings suggest that federated learning is a promising paradigm for AI model training in industries that require high data security, such as healthcare and finance.

Several researchers are proposing information systems-based Wireless Sensor Networks (WSNs) that provide an extensible and effective means to monitor large and diverse geographical areas. Nodes in a WSN are characterized by very limited computing capabilities and energy consumption is a major concern, which implies that communications should be minimized, thus unorthodox solutions are required for many situations. The definition of secure and privacy aware solutions, ensuring at the same time limited power consumption of transmitted data is then a great challenge. In this paper we present an hybrid mesh/sensor network, which allows to deliver a transparent multi-hop wireless backhaul able to handle in a secure way different kinds of data (temperature, humidity, etc.), coming from different kinds of wireless sensor networks. The main idea is based on a sharing of tasks between wireless mesh networks and wireless sensor networks. Our architecture is particularly suitable to realize an application agnostic mesh backhaul able to concurrently support multiple WSNs, while ensuring both end-to-end encryption and hop-by-hop authentication. Hence, in order to evaluate the performance of the proposed architecture an ad-hoc prototype is realized.

ABSTRACTVehicular Ad Hoc Networks (VANETs) play a pivotal role in enabling intelligent transportation systems, yet their decentralized and dynamic nature exposes them to a wide range of cyber threats, including Sybil attacks, black hole attacks, replay, and message spoofing. To address these vulnerabilities, we propose HyDra‐VANET, a novel hybrid security framework that integrates deep learning, federated learning, and homomorphic encryption for robust and privacy‐preserving intrusion detection. At the vehicle level, a convolutional–recurrent neural network (CRNN) is employed to extract both spatial and temporal patterns from real‐time vehicular communication and telemetry data, ensuring accurate anomaly detection. Federated learning coordinates decentralized model training across vehicles, enabling collaborative intelligence while eliminating the need to share raw data. To further enhance privacy, a lightweight lattice‐based homomorphic encryption scheme allows encrypted inference and secure aggregation, preventing sensitive information leakage at intermediate nodes such as roadside units. Experimental evaluation using multiple datasets and adversarial scenarios demonstrates that HyDra‐VANET significantly outperforms baseline intrusion detection systems in detection accuracy, resilience to adversarial manipulation, scalability, and communication efficiency.