SCIF: Privacy-Preserving Statistics Collection with Input Validation and Full Security

In the setting of secure multiparty computation, a set of parties wish to compute a joint function of their private inputs. The computation should preserve security properties such as privacy, correctness, independence of inputs, fairness and guaranteed output delivery. In the case of no honest majority, fairness and guaranteed output delivery cannot always be obtained. Thus, protocols for secure multiparty computation are typically of two disparate types: protocols that assume an honest majority (and achieve all properties including fairness and guaranteed output delivery), and protocols that do not assume an honest majority (and achieve all properties except for fairness and guaranteed output delivery). In addition, in the two-party case, fairness and guaranteed output delivery are equivalent. As a result, the properties of fairness (which means that if corrupted parties receive output then so do the honest parties) and guaranteed output delivery (which means that corrupted parties cannot prevent the honest parties from receiving output in any case) have typically been considered to be the same.

For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">secure aggregation</i> . However, secure aggregation makes model poisoning attacks such as backdooring more convenient given that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes a new federated learning technique SAFE-Learning to support backdoor detection for secure aggregation. We achieve this through two new primitives - <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">oblivious random grouping (ORG)</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">partial parameter disclosure (PPD)</i> . ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. ORG is based on our construction of several new primitives including tree-based random subgroup generation, oblivious secure aggregation, and randomized Diffie-Hellman key exchange. ORG can thwart colluding attackers from knowing each other’s group membership assignment with non-negligible advantage than random guess. Backdoor attacks are detected based on statistical distributions of the subgroup aggregated parameters of the learning iterations. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.

Federated Learning, as a multi-party machine learning paradigm, has garnered significant attention, but model updates may still leak sensitive information. Secure aggregation protocols are considered an effective solution for privacy protection in Federated Learning. However, in large-scale federated learning systems, designing efficient and practical secure aggregation remains a critical challenge. Moreover, while secure aggregation effectively conceals model updates, it unintentionally complicates the detection and mitigation of poisoning attacks, thereby exposing the system to vulnerabilities from both data and model poisoning. To address these challenges, we propose ClusterGuard, a secure clustered aggregation scheme. ClusterGuard leverages Verifiable Random Function (VRF) to ensure fair and transparent client clustering. Within each cluster, it employs a lightweight key-homomorphic masking mechanism combined with verifiable secret sharing to enable secure and efficient aggregation. Fur thermore, we design a dual filtering mechanism based on cosine similarity and norm to effectively detect and resist poisoning attacks. We provide two variants of ClusterGuard for both client-server and decentralized environments with blockchains, respectively. Extensive experiments on standard datasets demonstrate that ClusterGuard achieves over 2× efficiency improvement compared to advanced secure aggregation methods. Even with 20% of clients being malicious, the trained model maintains accuracy comparable to the original model, outperforming state-of-the art robustness solutions. ClusterGuard provides a more efficient, secure, and robust solution for practical federated learning.

Two settings are typically considered for secure multipartycomputation, depending on whether or not a majority of the partiesare assumed to be honest. Protocols designed under this assumptionprovide full (and, in particular, guarantee outputdelivery and fairness) when this assumption is correct; however, if half or more of the parties are dishonest then security iscompletely compromised. On the other hand, protocols toleratingarbitrarily-many faults do not provide fairness or guaranteed output delivery even if only a single party is dishonest. It isnatural to wonder whether it is possible to achieve the ofboth worlds : namely, a single protocol that simultaneouslyachieves the best possible security in both the above settings. Ishai, et al. (Crypto 2006) recently addressed this question, andruled out constant-round protocols of this type.As our main result, we completely settle the question by ruling outprotocols using any (expected) polynomial number of rounds. Given this stark negative result, we then ask what can be achieved if we are willing to assume simultaneous message transmission (or, equivalently, a non-rushing adversary). In this setting, we show that impossibility still holdsfor logarithmic-round protocols. We also show, for any polynomialp, a protocol (whose round complexity depends on p) that can be simulated to within closeness O(1/p).

Secure Multi-party Computation (MPC) with small population and honest majority has drawn focus specifically due to customization in techniques and resulting efficiency that the constructions can offer. In this work, we investigate a wide range of security notions in the five-party setting, tolerating two active corruptions. Being constant-round, our protocols are best suited for real-time, high latency networks such as the Internet. In a minimal setting of pairwise-private channels, we present efficient instantiations with unanimous abort (where either all honest parties obtain the output or none of them do) and fairness (where the adversary obtains its output only if all honest parties also receive it). With the presence of an additional broadcast channel (known to be necessary), we present a construction with guaranteed output delivery (where any adversarial behaviour cannot prevent the honest parties from receiving the output). The broadcast communication is minimal and independent of circuit size. In terms of performance (communication and run time), our protocols incur minimal overhead over the best known protocol of Chandran et al. (ACM CCS 2016) that achieves the least security of selective abort. Further, our protocols for fairness and unanimous abort can be extended to n-parties with at most √n corruptions, similar to Chandran et al. Going beyond the most popular honest-majority setting of three parties with one corruption, our results demonstrate feasibility of attaining stronger security notions for more than one active corruption at an expense not too far from the least desired security of selective abort.

Federated learning (FL) enables multiple clients to exchange gradients to facilitate collaborative training in edge computing without transferring private data to the cloud server. However, the malicious server may disrupt the model training process by obtaining gradients to infer client information or faking validation results. Considering these threats, we construct a dynamic, secure, and verifiable FL scheme, named DSVFL. Specifically, we propose the fine-grained top-<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> gradient selection algorithm to accelerate model convergence, which can improve model accuracy by up to 49.14%. Furthermore, we propose a single-cloud secure aggregation protocol that guarantees the server cannot access the real model parameters. We also design a trusted verification algorithm to validate the server's aggregation results while resisting collusion between the server and clients. For federation dynamics, we adopt the Shamir's secret sharing in both the aggregation and verification phases, which enables the correct aggregation and decryption of ciphertexts and the independent verification of client signatures, even in cases of client dropouts. Rigorous theoretical analysis demonstrates that DSVFL can protect data privacy and ensure correct training results. Experimental results indicate that DSVFL can reduce clients' computational cost by 48%-63% and communication overhead by 33%-49% compared with existing solutions.

In light of the emergence of privacy breaches in federated learning, secure aggregation protocols, which mainly adopt either homomorphic encryption or threshold secret sharing techniques, have been extensively developed to preserve the privacy of each client's local gradient. Nevertheless, many existing schemes suffer from either poor capability of privacy protection or expensive computational and communication overheads. Accordingly, in this paper, we propose an efficient and multi-private key secure aggregation scheme for federated learning. Specifically, we skillfully design a multi-private key secure aggregation algorithm that achieves homomorphic addition operation, with two important benefits: 1) both the server and each client can freely select public and private keys without introducing a trusted third party, and 2) the plaintext space is relatively large, making it more suitable for deep models. Besides, for dealing with the high dimensional deep model parameter, we introduce a super-increasing sequence to compress multi-dimensional data into one dimension, which greatly reduces encryption and decryption times as well as communication for ciphertext transmission. Detailed security analyses show that our proposed scheme can achieve semantic security of both individual local gradients and the aggregated result while achieving optimal robustness in tolerating client collusion. Extensive simulations demonstrate that the accuracy of our scheme is almost the same as the non-private approach, while the efficiency of our scheme is much better than the state-of-the-art baselines. More importantly, the efficiency advantages of our scheme will become increasingly prominent as the number of model parameters increases.

Sensor applications often leverage in-network aggregation to extract aggregates, such as predicate count and average, from the network. With in-network aggregation, a malicious sensor can easily manipulate the intermediate aggregation results and corrupt the final answer. Most existing secure aggregation schemes aim to defend against stealth attacks and can only raise an alarm when the final answer is corrupted, without being able to pinpoint and revoke the malicious sensors. While some recent protocols can pinpoint and revoke malicious sensors, they need to rely on expensive public key cryptography to be robust against certain attacks. Using only symmetric key cryptography, this paper aims to strictly diminish the capability of adversaries whenever they launch a successful attack, so that malicious sensors can only ruin the aggregation result for a small number of times before they are fully revoked. To this end, we propose VMAT (verifiable minimum with audit trail), a novel secure aggregation protocol with malicious sensor revocation capability. VMAT relies on symmetric key cryptography only, and provides provable guarantees that each execution can either produce the correct aggregation result efficiently, or revoke some key held by the adversary.

Guaranteed Output Delivery with More than 1/3 of Malicious Corruption for Client Server MPC Protocols and Applications

We study the communication complexity of unconditionally secure MPC with guaranteed output delivery over point-to-point channels for corruption threshold $$t < n/2$$ , assuming the existence of a public broadcast channel. We ask the question: “is it possible to construct MPC in this setting s.t. the communication complexity per multiplication gate is linear in the number of parties?” While a number of works have focused on reducing the communication complexity in this setting, the answer to the above question has remained elusive until now. We also focus on the concrete communication complexity of evaluating each multiplication gate. We resolve the above question in the affirmative by providing an MPC with communication complexity $$O(Cn\phi )$$ bits (ignoring fixed terms which are independent of the circuit) where $$\phi $$ is the length of an element in the field, C is the size of the (arithmetic) circuit, n is the number of parties. This is the first construction where the asymptotic communication complexity matches the best-known semi-honest protocol. This represents a strict improvement over the previously best-known communication complexity of $$O(C(n\phi \,+\,\kappa )\,+\,D_Mn^2\kappa )$$ bits, where $$\kappa $$ is the security parameter and $$D_M$$ is the multiplicative depth of the circuit. Furthermore, the concrete communication complexity per multiplication gate is 5.5 field elements per party in the best case and 7.5 field elements in the worst case when one or more corrupted parties have been identified. This also roughly matches the best-known semi-honest protocol, which requires 5.5 field elements per gate. The above also yields the first secure-with-abort MPC protocol with the same cost per multiplication gate as the best-known semi-honest protocol. Our main result is obtained by compiling the secure-with-abort MPC protocol into a fully secure one.

Enabling search directly over encrypted data is a desirable technique to allow users to effectively utilize encrypted data outsourced to a remote server like cloud service provider. So far, most existing solutions focus on an honest-but-curious server, while security designs against a malicious server have not drawn enough attention. It is not until recently that a few works address the issue of verifiable designs that enable the data owner to verify the integrity of search results. Unfortunately, these verification mechanisms are highly dependent on the specific encrypted search index structures, and fail to support complex queries. There is a lack of a general verification mechanism that can be applied to all search schemes. Moreover, no effective countermeasures (e.g., punishing the cheater) are available when an unfaithful server is detected. In this work, we explore the potential of smart contract in Ethereum, an emerging blockchain-based decentralized technology that provides a new paradigm for trusted and transparent computing. By replacing the central server with a carefully-designed smart contract, we construct a decentralized privacy-preserving search scheme where the data owner can receive correct search results with assurance and without worrying about potential wrongdoings of a malicious server. To better support practical applications, we introduce fairness to our scheme by designing a new smart contract for a financially-fair search construction, in which every participant (especially in the multiuser setting) is treated equally and incentivized to conform to correct computations. In this way, an honest party can always gain what he deserves while a malicious one gets nothing. Finally, we implement a prototype of our construction and deploy it to a locally simulated network and an official Ethereum test network, respectively. The extensive experiments and evaluations demonstrate the practicability of our decentralized search scheme over encrypted data.

Federated Learning (FL) is a transformative paradigm that enables collaborative machine learning across multiple decentralized data sources without requiring direct data sharing. This approach has emerged as a critical solution for privacy-preserving machine learning, particularly in sensitive domains such as healthcare, finance, and IoT systems. FL frameworks employ advanced techniques such as secure aggregation, differential privacy, and homomorphic encryption to protect user data while facilitating model convergence. These frameworks address key challenges, including communication efficiency, data heterogeneity, and robustness against malicious actors. This paper reviews the state-of-the-art FL frameworks, exploring their architecture, privacy-preserving techniques, and application scenarios. Furthermore, it highlights recent advancements in secure federated learning protocols, multi-party computation strategies, and scalability improvements. The discussion extends to open challenges, such as ensuring fairness, optimizing resource consumption, and maintaining security guarantees in adversarial settings. By advancing the development of privacy-preserving FL frameworks, researchers and practitioners can unlock the potential of collaborative machine learning while upholding stringent data privacy standards.

Federated Learning (FL) enables collaborative model training across distributed users, while preserving data privacy by only sharing model updates. However, secure aggregation, which is essential to prevent data leakage during this process, often incurs significant communication and computational costs. Moreover, existing schemes rarely consider whether they can resist quantum attacks. To address these challenges, we propose an efficient, post-quantum aggregation protocol based on a Key Homomorphic Pseudo-Random Function (KHPRF). Our non-interactive mask elimination mechanism reduces aggregation to a single round, significantly minimizing the communication overhead. Furthermore, the KHPRF keys are reusable, enabling multiple aggregations with a one-time initialization, thereby enhancing efficiency in cross-silo federated learning. Compared to existing schemes, our approach achieves quantum-resistant aggregation with improved efficiency.

Network-based attacks have become common and intervened. For this reason, detecting systems are now shifting their focus from host to network. Skimmers routinely perform “portscans” to search the vulnerable servers to intervene. Network Intrusion Detection Systems (NIDS) try to detect such behavior and flag them as malicious. An important requirement in such systems is instant response: the faster a NIDS detects malice, the lesser would be the resulting damage. At the same time, NIDS should not pseudo implicate the remote hosts as malicious. Balancing the promptness and accuracy in identifying malicious activity is a delicate and typical task. We develop detection system. TanceQi is a design which determines unfaithful processes and malicious services into our network in a fast and significant manner without having any tracking in route. This simplifies the work of admin and also performs monitoring faster and more accurately than the other than other current solutions.

Healthcare data holds immense potential to improve diagnostics and treatment, but centralized collection risks patient privacy and suffers from limited labeled samples. Existing methods fall short in securely leveraging distributed data while reducing annotation costs. To address this, we propose FTAL ‐ QNC —a novel Federated Transfer Active Learning framework with Quantized Neural Cryptography—that enables privacy‐preserving, communication‐efficient, and label‐efficient collaborative model training. FTAL ‐ QNC integrates four core components in a unified architecture: (1) Federated learning for decentralized model training without data sharing, (2) Transfer learning to handle data heterogeneity across hospitals, (3) Active learning to minimize manual labeling by prioritizing informative samples, and (4) Quantized neural cryptography to ensure secure, low‐overhead exchange of encrypted model updates. Empirical evaluations on real‐world datasets, including Lung CT and ChestX ‐ray14, demonstrate that FTAL ‐ QNC enhances segmentation and classification accuracy to 97.3% and 97.0% recall for Lung CT , respectively, while significantly reducing annotation effort compared to standard federated learning and other sampling methods. Our contributions include a privacy‐preserving and communication‐efficient collaborative framework, an integrated active learning mechanism for efficient data labeling, and a secure aggregation protocol via quantized neural cryptography. These results demonstrate FTAL ‐ QNC 's potential to advance safe, collaborative medical research and improve patient outcomes.