Federated Learning (FL) enables collaborative model training across distributed clients without exposing raw privacy-sensitive data. To ensure confidentiality against honest-but-curious aggregation servers, Additive Homomorphic Encryption, such as the Paillier cryptosystem, is widely deployed. However, preserving the integrity and authenticity of the homomorphically encrypted local updates remains a critical challenge. Traditional cryptographic signatures introduce significant communication overhead and metadata management complexities, which exacerbate the inherent bandwidth bottlenecks of FL. In this paper, we introduce a metadata-free integrity protection scheme based on Deterministic Self-Blinding (DSB). By deterministically re-randomizing specific Paillier ciphertexts to encode bits via interval membership, DSB allows clients to embed a complete digital signature directly within the encrypted model updates. This operation requires a constant-time (O(1)) modular subtraction per signature bit, entirely avoiding the computationally expensive random searches of Probabilistic Self-Blinding approaches. Furthermore, we formalize the security of the DSB mechanism through a rigorous adversary-challenger reduction, proving that it preserves the IND-CPA security of Paillier while ensuring strong EUF-CMA unforgeability against active network adversaries. Experimental results demonstrate that our scheme achieves strict zero communication overhead and negligible computation latency without degrading the global model’s accuracy. Our protocol offers a highly efficient, framework-agnostic security foundation that can be seamlessly integrated into production-grade privacy-preserving FL deployments.

White-box watermarking embeds ownership signatures directly into DNN parameters, yet it faces a critical blind spot: topology-altering obfuscation. By modifying a model’s internal structure while preserving its input-output behavior, an attacker can misalign the watermark from its expected parameter locations, causing standard white-box extractors to fail. We investigate whether existing white-box watermarks remain verifiable after such attacks by introducing Distillation-as-Defense: rather than reversing the obfuscation, we distill the obfuscated model (Teacher) into a student with the original architecture, forcing it to reconstruct the functional watermark representation. We systematically evaluate ten white-box watermarking schemes—eight static (weight-based) and two dynamic (activation-based)—across classifiers, generative models, and transformers. Dynamic methods consistently recover their watermarks under feature-map alignment distillation, while most static methods fail on deep architectures due to internal representation redundancy. These findings reveal that current white-box schemes were not designed with distillation robustness in mind. We conclude that resistance to distillation is a necessary condition for a white-box watermark to withstand topology-altering obfuscation, and we discuss a concrete design guidelines toward this goal.

International audience

In this paper, we propose an homomorphic proxy re-encryption scheme (HPRE) that allows different users to share data they outsourced homomorphically encrypted using their respective public keys with the possibility by next to process such data remotely. Its originality stands on a solution we propose so as to compute the difference of data encrypted with Damgard-Jurik cryptosystem. It takes also advantage of a secure combined linear congruential generator that we implemented in the Damgard-Jurik encrypted domain. Basically, in our HPRE scheme, the two users, the delegator and the delegate, ask the cloud server to generate an encrypted noise based on a secret key, both users previously agreed on. Based on our solution to compute the difference in Damgard-Jurik encrypted domain, the cloud computes in clear the differences in-between the encrypted noise and the encrypted data of the delegator, obtaining thus blinded data. In order the delegate gets access to the data, the cloud just has to encrypt these differences using the delegate's public key and then removes the noise. This solution doesn't need extra communication between the cloud and the delegator. Our HPRE was implemented in the case of the sharing of uncompressed images stored in the cloud showing good time computation performance, it is unidirectional and collusion-resistant. Nevertheless, it is not limited to images and can be used with any kinds of data.