Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learning

Federated learning (FL) has become a promising technology to provide edge Artificial Intelligence (AI) due to its advantages in privacy protection and reduced communication costs. However, FL is still confronted with privacy leakage issues because the sharing local model may expose the training data information. Existing works typically utilize secure aggregation techniques to eliminate privacy leakage, where local model parameters in FL are obfuscated before they are sent to the aggregator. Nevertheless, secure aggregation makes poisoning attacks more convenient given that existing anomaly detection methods mostly require access to plaintext local models. A Poisoning-Defense Secure Aggregation in FL (PDSA-FL) is proposed to enhance the privacy protection of honest clients and defend against poisoning attacks from malicious clients. Specifically, a Secure Aggregation scheme based on Random Parameters Decomposition (SARPD) is designed to protect client privacy during the FL aggregation process and eliminates the impact of dropped clients on the aggregation results. Secondly, a Poisoning Detection method based on Similarity Grouping (PDSG) is proposed to mitigate the impact of poisoning attacks on the global model of FL without leaking client model parameters. The security analysis discusses the effectiveness of the proposed PDSA-FL in terms of privacy protection. Extensive simulation results show that PDSA-FL can effectively defend against poisoning attacks, significantly improve the convergence performance of global models, and reduce the computation time of clients.

In this paper, the convergence time of federated learning (FL), when deployed over a realistic wireless network, is studied. In particular, a wireless network is considered in which wireless users transmit their local FL models (trained using their locally collected data) to a base station (BS). The BS, acting as a central controller, generates a global FL model using the received local FL models and broadcasts it back to all users. Due to the limited number of resource blocks (RBs) in a wireless network, only a subset of users can be selected to transmit their local FL model parameters to the BS at each learning step. Moreover, since each user has unique training data samples, the BS prefers to include all local user FL models to generate a converged global FL model. Hence, the FL training loss and convergence time will be significantly affected by the user selection scheme. Therefore, it is necessary to design an appropriate user selection scheme that can select the users who can contribute toward improving the FL convergence speed more frequently. This joint learning, wireless resource allocation, and user selection problem is formulated as an optimization problem whose goal is to minimize the FL convergence time and the FL training loss. To solve this problem, a probabilistic user selection scheme is proposed such that the BS is connected to the users whose local FL models have significant effects on the global FL model with high probabilities. Given the user selection policy, the uplink RB allocation can be determined. To further reduce the FL convergence time, artificial neural networks (ANNs) are used to estimate the local FL models of the users that are not allocated any RBs for local FL model transmission at each given learning step, which enables the BS to improve the global model, the FL convergence speed, and the training loss. Simulation results show that the proposed approach can reduce the FL convergence time by up to 56% and improve the accuracy of identifying handwritten digits by up to 3%, compared to a standard FL algorithm.

Federated Learning (FL) is an emerging technique to enhance edge intelligence, where mobile devices train machine learning models collaboratively with their local data. Limited energy on devices and scarce wireless bandwidth can notably impact the convergence of FL over wireless networks, and thus device scheduling and resource allocation are critical. In this paper, we propose a joint device scheduling and resource allocation scheme to maximize the model accuracy under total training delay and device energy budgets. Since FL consists of multiple training rounds, there is an inherent trade-off between per-round delay, per-round energy consumption, and the total number of rounds. To find solution, we decouple the accuracy maximization problem into two sub-problems. First, given a scheduling policy, the bandwidth allocation and local computing frequency are jointly optimized to maximize the number of rounds that can be conducted. Then, a device scheduling policy is proposed to balance the trade-off between the per-round energy and delay cost and the number of rounds, with the ultimate goal of accuracy optimization. Experiments on various learning tasks and datasets show that the proposed scheme can greatly improve the convergence rate of resource-constrained FL.

In modern devices, such as smartphones and IoT, AI hardware implements different ML models to train massive amounts of data for various applications. However, based on the sensitivity of this data, privacy and security concerns, or both, may restrict users from accessing the data storage to conduct the ML training using conventional methods. Federated learning (FL) is consequently emerged to maintain training data distribution among smart mobile devices while aggregating locally processed updates. In addition to improving the model training performance as the number of clients rises, FL also creates a privacy-preserved shared data model. FL execution, however, can be time-consuming. This study proposes a parallelized approach to enhance the performance and privacy of the FL algorithm (FedAvg). In this regard, the FedAvg algorithm is expanded to our proposed model, distributed FedAvg (D-FedAvg), which enables several clients to collaborate concurrently and train a single learning model. To evaluate the performance of the proposed model, we investigated the impact of various numbers of clients and training rounds on the result. To validate our findings, we conducted extensive experiments using MNIST datasets trained using two federated learning models, MLP and CNN. The results show our D-FedAvg can maintain data privacy and dramatically enhance the execution time of FL compared to traditional FedAvg. According to the study, the FL framework's time complexity increases as the number of clients and rounds increases, but parallelization allows it to operate 2–3 times faster than usual.

Intelligent reflecting surface (IRS) has been proposed as a potential solution to improve the performance of many aspects for future wireless communication. However, the issue of user's privacy in IRS assisted communications is often ignored in previous works. In this paper, we propose an algorithm, namely optimal beam reflection based on federated learning (OBR-FL), to achieve high speed communication with the sparse channel state information (CSI). The corresponding configuration matrix of IRS can be determined by the trained model according to the CSI of user to achieve the optimal communication rate. Based on federated learning (FL), several local models are trained with the local dataset of each user and upload them to a central server for aggregation to generate a global model. Then, each user downloads this global model as the initial configuration for next training round. Finally, the optimal model is obtained after several iterations. During the training process, the private data of each user is managed and processed locally. Simulation results demonstrate that the achievable rate performance of the proposed algorithm can effectively approach to that of the centralized machine learning (ML) while protecting user's privacy.

To address privacy concerns, federated learning (FL) is becoming a promising machine learning technique which enables multiple decentralized clients to train a shared model collaboratively while preserving their private training data. Although FL may reduce the risks of data leak, it is still possible for hackers to reverse-engineer a trained model and figure out the information in the original training dataset provided by a FL client. In order to avoid such risks, secure aggregation (SA) can be used to privately combine the trained models of the clients to update the shared model. However, SA usually introduces performance overhead as it requires additional computation for encryption operations and even communications when secure multi-party computation (SMPC) is used. In this paper, we analyze the performance of FL with SA using PySyft, an open source framework including FL implementation, and propose an asynchronous FL mechanism to improve the overall performance. It turns out that the performance depends on the computational capabilities of the clients and the characteristics of the communication network, and we propose a performance modeling method to help system designers break down the execution time and decide on suitable trade-offs between privacy, efficiency, and accuracy for a balanced system.

Blockchain network (BCN)-based Self-Sovereign Identity (SSI) has emerged lately as an identity and access management framework that is based on Distributed Ledger Technology (DLT) and allows users to control their own data. Federated Learning (FL), on the other hand, provides a collaborative framework to update Machine Learning (ML) models without relying explicitly on data exchange between the users. This paper investigates identity management and authentication for vehicle users in the context of FL. We propose a novel approach based on blockchain-based SSI, which focuses on maintaining the authenticity and integrity of vehicle users’ identities and data exchanged between the users and the aggregation server during the execution of the FL iterations. A primary objective of this paper is to achieve shorter durations for credential operations in an FL setting as the system size scales out. Integrating BCN-based SSI into the FL framework addresses several critical FL challenges, ensuring enhanced system security and operational integrity. This synergy of BCN-based SSI with federated learning enables robust identity verification providing a solution to fundamental trustworthiness issues in FL without sacrificing the benefits of decentralized data control, improving both the performance and reliability of the FL system. Experimental results suggest that the proposed FL-based system, together with credential management on a blockchain platform, has the potential to significantly improve data integrity and ensure the authentication of users. More specifically, the results of the FL system demonstrate that it takes longer (on the order of a hundred seconds) as the number of rounds and clients increase, while the implemented Decentralized Identifier (DID) system relying on BCN-based SSI has dramatically shorter dedicated time for completing credential operations.

Federated Learning (FL) is a Machine Learning (ML) paradigm in which multiple devices collaboratively train a model without sharing their local data. This decentralized approach provides significant privacy benefits, enabling compliance with data protection regulations and safeguarding sensitive user information by keeping raw data on local devices. Instead of transmitting raw data, FL sends model updates to a central aggregator to improve the global model. However, this process can result in higher Carbon Dioxide (CO₂) emissions compared to traditional centralized ML systems, due to the increased number of participating devices and communication rounds. This study evaluates the performance, convergence speed, energy efficiency, and environmental impact of FL models compared to centralized models, using the Modified National Institute of Standards and Technology dataset (MNIST) and Canadian Institute for Advanced Research-10 classes dataset (CIFAR-10). Four models were tested: two FL models and two centralized models. The evaluation focused on accuracy, number of training rounds to convergence, and total CO₂ emissions. To optimize both convergence and energy efficiency, a dynamic hill-climbing-based early stopping technique was introduced. After every 100 rounds, model accuracy improvements were assessed, and training was terminated early if further gains fell below a shrinking threshold, effectively reducing unnecessary computation and energy consumption. Results show that, under the tested conditions, FL models achieved competitive or higher accuracy than centralized models, particularly on non-Independent and Identically Distributed (IID) data distributions. For example, the federated MNIST model reached 98.79% accuracy with a significantly lower carbon footprint when early stopping was applied. Overall, the proposed optimization approach reduced CO₂ emissions by approximately 60% without substantial loss in accuracy. By integrating privacy preservation, explicit regulatory relevance, and a practical dynamic optimization method, this research demonstrates that FL can deliver strong model performance while meeting modern requirements for data privacy and environmental sustainability

This article provides a comprehensive survey of aggregation strategies in federated learning (FL). This decentralized machine learning (ML) paradigm enables multiple clients to collaboratively train models without sharing their local datasets. Aggregation is a pivotal aspect of FL, as it integrates model updates from diverse clients into a unified global model while addressing critical challenges such as data heterogeneity, scalability, and privacy preservation. The study categorizes aggregation strategies into three primary approaches: data-centric, model-centric, and secure aggregation, each tailored to address distinct problems in FL systems. Data-centric strategies focus on addressing non-independent and identically distributed (non-IID) data across clients, ensuring that model updates account for imbalances in data distributions. Model-centric strategies optimize the aggregation of model parameters, emphasizing techniques such as weighted averaging and model distillation to improve model performance across clients with diverse data characteristics. Secure aggregation techniques aim to enhance privacy and robustness, protecting client data from potential adversarial threats through encryption-based methods like secure multi-party computation (SMPC) and Byzantine-resilient techniques. The analysis delves into the advantages and limitations of these aggregation strategies, particularly their role in tackling challenges like non-IID data, communication efficiency, and resistance to adversarial attacks. Furthermore, the article identifies existing research gaps in FL, including the need for more scalable and robust aggregation methods capable of reducing communication costs, enhancing privacy guarantees, and improving performance in highly heterogeneous environments. These insights provide a roadmap for future research aimed at advancing aggregation strategies in FL to improve model accuracy, security, and efficiency in real-world applications.

In Federated Learning (FL), two-way model exchanges are required between the server and the workers every training round. Due to the large size of machine learning models, communications between them lead to high training delay and economic cost. At present, communication-efficient FL methods, for examples, top-k sparsification and quantization, taking advantages of the sparseness of model gradients and the fact that gradient-based model updating can tolerance small deviations, effectively reduce the communication cost of single training round. However, these gradient-based communication-efficient schemes cannot be applied to downlink communication. In addition, they cannot be used in conjunction with those communicationfrequency-suppressed methods, e.g., FedAvg, which hinders them from further improving training efficiency. In this paper, we propose FedCS, a compressive sensing based FL method, which can effectively compress and accurately reconstruct non-sparse model (both local and global) parameters (iveights), and can reduce the overall communication cost up to 10 $\times$ as compared to FedAvg without decreasing test accuracy. We introduce 1) a dictionary learning scheme with a quasi-validation set, which helps to project non-sparse parameters onto a sparse domain; 2) ajoint reconstruction scheme, by using which the server recovers global model parameters by executing the reconstruction algorithm only once a round, regardless of the number of compressed local models; 3) a compression ratio adjustment strategy, which balances the trade-off between total communication cost and model accuracy. We perform FedCS on three image classification tasks, and compare it with FedAvg, FedPAQ and T-FedAvg (two improvements of FedAvg). Experimental results demonstrate that FedCS outperforms comparison methods in all tasks, and always maintains a comparable test accuracy to FedAvg, even using a small quasi-validation set and on Non-IId data.

Federated learning (FL) is gradually becoming a key learning paradigm in Privacy-preserving Machine Learning (ML) systems. In FL, a large number of clients cooperate with a central server to learn a shared model without sharing their own data sets. However, since there is a great disparity between the client data sets, standard FL is often hard to tune and suffers from performance degradation due to the inharmony among local models. To this end, in this paper we propose a novel FL scheme, termed client reputation federated learning (CRFL), which dynamically assesses the reputation of the clients participating in FL. Our method leverages techniques from model explanation, and aims at precisely measure each client's impact to the global model. To be specific, we first calculate the saliency-weighted variance on pixelwise relevance scores as the quality factor of a single sample. Then we extract activation function values at the last hidden layer to compute the divergence factor of individual data set. Finally, the server integrates these two factors as an assessment of the client reputation. By leveraging such assessment, CRFL can dynamically adjust the weights of the clients in each aggregation round, thus leading to a significant improvement over the baseline method in terms of model accuracy and convergence rate. Intensive experiments are conducted on the MNIST and CIFAR-10 data sets, and experimental results demonstrate the efficacy of the proposed method.

Federated Learning (FL) allows several data owners to train a joint model without sharing their training data. Such a paradigm is useful for better privacy in many ubiquitous computing systems. However, FL is vulnerable to poisoning attacks, where malicious participants attempt to inject a backdoor task in the model at training time, along with the main task that the model was initially trained for. Recent works show that FL is particularly vulnerable to edge-case backdoors introduced by data points with unusual out-of-distribution features. Such attacks are among the most difficult to counter, and today's FL defense mechanisms usually fail to tackle them. In this paper, we present ARMOR, a defense mechanism that leverages adversarial learning to uncover edge-case backdoors. In contrast to most of existing FL defenses, ARMOR does not require real data samples and is compatible with secure aggregation, thus, providing better FL privacy protection. ARMOR relies on GANs (Generative Adversarial Networks) to extract data features from model updates, and uses the generated samples to test the activation of potential edge-case backdoors in the model. Our experimental evaluations with three widely used datasets and neural networks show that ARMOR can tackle edge-case backdoors with 95% resilience against attacks, and without hurting model quality.

FedHEONN: Federated and homomorphically encrypted learning method for one-layer neural networks

The convergence of vehicular technology, artificial intelligence (AI), and distributed computing has catalyzed the emergence of the Internet of Vehicles (IoV) as a cornerstone of next-generation intelligent transportation systems (ITS). By enabling vehicle-to-everything (V2X) communication, IoV supports cooperative perception, real-time decision-making, and autonomous driving. However, the reliance on large-scale, data-driven intelligence in IoV exposes systems to critical challenges, including adversarial poisoning, privacy leakage, identity forgery, and the fragility of centralized learning architectures. Federated Learning (FL) has been proposed as a promising paradigm to alleviate some of these issues by enabling distributed model training without centralizing sensitive vehicular data. Nonetheless, conventional FL remains vulnerable to security and trust limitations, particularly in dynamic vehicular environments. This thesis addresses these challenges by designing secure, privacy-preserving, and scalable FL frameworks that leverage distributed ledger technologies and cutting-edge security mechanisms.The thesis advances knowledge through four interconnected contributions. First, two novel optimization-driven poisoning attack models are introduced: PA-PSOSA and PAPSOGA, which combine particle swarm optimization with simulated annealing and genetic algorithms, respectively. These models demonstrate that even a small poisoning budget can substantially degrade global model utility under black-box and clean-label constraints, highlighting the urgency of robust defenses in vehicular FL. Second, a permissioned blockchain-enabled FL (BCFL) framework is proposed, in which consortium edge nodes running Practical Byzantine Fault Tolerance (PBFT) consensus replace the central aggregator. With blockchain integration and data validation mechanisms, this design ensures identity authentication, verifiable audit trails, and improved resilience against poisoning and Sybil attacks, while maintaining high model accuracy under adversarial conditions. Third, the framework is further enhanced to achieve inference-resistance by integrating secure aggregation (SecAgg) and differential privacy (DP), and lightweight with off-chain commitments. This design significantly reduces ledger storage requirements, increases system throughput, and mitigates inference-based privacy risks. Finally, to overcome the scalability limitations of PBFT-based BCFL, a DAG-enabled FL (DFL) framework is developed. By leveraging parallel validation, utility-score-based tip selection, and reputation-weighted aggregation, this framework significantly improves scalability, reduces communication complexity, and enhances robustness in asynchronous vehicular environments.Together, these contributions articulate a coherent progression from exposing vulnerabilities in vehicular FL to constructing secure, privacy-preserving, and scalable frameworks tailored for IoV ecosystems. The findings demonstrate that interdisciplinary integration of optimization theory, cryptography, differential privacy, and distributed ledger technologies is indispensable for trustworthy vehicular intelligence. Beyond theoretical significance, the proposed frameworks offer practical designs for deployment in safety-critical IoV environments. Future research directions include the integration of zero-knowledge proofs (ZKP) for verifiable privacy, adaptive defenses against evolving adversarial strategies, and experimental validation in real-world vehicular testbeds. Collectively, this thesis establishes a foundation for secure federated intelligence in IoV, contributing to the reliability, efficiency, and trustworthiness of next-generation ITS.

Federated Learning (FL) is revolutionizing privacy in distributed IoT systems by eliminating the need to share raw data. However, it has its challenges. On the client side, attackers can tamper with data or inject false information, leading to what's known as backdoor poisoning attacks. Meanwhile, central servers can compromise data integrity and privacy by manipulating updates and extracting sensitive information from gradients. This is particularly problematic in IoT networks where user privacy is paramount. Innovative techniques like differential privacy and secure aggregation are being developed to tackle these issues and protect user data. Communication and learning convergence also pose significant hurdles due to uneven data distribution and the varied capabilities of IoT devices. To address this, new communication protocols and optimization algorithms are being implemented. Resource management is another critical area, given the limited computational power of many IoT devices. Solutions like resource-aware FL architectures and optimized AI models are emerging to ease these constraints. Additionally, advancements in AI hardware and lightweight training strategies are making deploying AI on IoT sensors more feasible. Finally, adopting standards such as ETSI Multi-access Edge Computing (MEC) and modern communication protocols is essential for the widespread deployment of FL-IoT systems, ensuring they are secure, efficient, and interoperable.