Federated learning is a widely used method for collaborative machine learning without sharing local data. In this approach, participants train models using their local data, and the model updates are aggregated into a global model. However, ensuring trustworthy model training is crucial because malicious participants may not use their actual local data or may not train the model as intended, which makes it challenging to guarantee the authenticity of the data and the integrity of the model training. To address these issues, we propose a trustworthy model training scheme (TMT-FL) with verifiable authenticity and integrity. Specifically, we leverage zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) based proofs to verify the integrity of the training execution. To deal with the performance bottleneck in generating zk-SNARK proofs, we use the Chinese Remainder Theorem to optimize the convolution operation, and present an improved zk-SNARK based proof generating scheme which significantly reduces the online proving time. Besides, we adopt matrix commitment along with bloom filter to ensure the authenticity and integrity of the training datasets. Extensive experimental results demonstrate that our improved zk-SNARK scheme performs nearly$3.1\times$faster than the state-of-the-art in online proving time. Moreover, we experimentally confirm the efficiency of TMT-FL under diverse datasets in terms of computational costs, storage costs, and communication overheads.

Secure Aggregation (SA), in the Federated Learning (FL) setting, enables distributed clients to collaboratively learn a shared global model while keeping their raw data and local gradients private. However, when SA is implemented in edge-intelligence-driven FL, the open and heterogeneous environments will hinder model aggregation, slow down model convergence speed, and decrease model generalization ability. To address these issues, we present a Robust and adaptive Secure Aggregation (RaSA) protocol to guarantee robustness and privacy in the presence of non-IID data, heterogeneous system, and malicious edge servers. Specifically, we first design an adaptive weights updating strategy to address the non-IID data issue by considering the impact of both gradient similarity and gradient diversity on the model aggregation. Meanwhile, we enhance privacy protection by preventing privacy leakage from both gradients and aggregation weights. Different from previous work, we address system heterogeneity in the case of malicious attacks, and the malicious behavior from edge servers can be detected by the proposed verifiable approach. Moreover, we eliminate the influence of straggling communication links and dropouts on the model convergence by combining efficient product-coded computing with repetition-based secret sharing. Finally, we perform a theoretical analysis that proves the security of RaSA. Extensive experimental results show that RaSA can ensure model convergence without affecting the generalization ability under non-IID scenarios. Moreover, the decoding efficiency of RaSA achieves 1.33× and 6.4× faster than the state-of-the-art product-coded and one-dimensional coded computing schemes.

Split Vertical Federated Learning (Split VFL) is an increasingly popular framework for collaborative machine learning on vertically partitioned data. However, it is vulnerable to various attacks, resulting in privacy leakage and robust aggregation issues. Recent works have explored the privacy protection of raw data samples and labels, neglecting malicious attacks launched by dishonest passive parties. Since they may deviate from the protocol and launch embedding poisoning attacks and free-riding attacks, it will inevitably result in model performance loss. To address this issue, we propose a Robust Privacy-preserving forward Aggregation (RoPA) protocol, which can resist embedding poisoning attacks and free-riding attacks and protect the privacy of embedding vectors. Specifically, we first present a modified Secret-shared Non-Interactive Proofs (SNIP) algorithm to guarantee the integrity verification of embedding vectors. To prevent free-riding attacks, we also give a validity verification protocol using matrix commitment. In particular, we utilize probability checking and batch verification to improve the verification efficiency of the protocol. Moreover, we adopt arithmetic secret sharing to protect data privacy. Finally, we conduct rigorous theoretical analysis to prove the security of RoPA and evaluate the performance of RoPA. The experimental results show that the proof verification overhead of RoPA is approximately 8× lower than the original SNIP, and the model accuracy is improved by ranging from 3% to 15% under the above two malicious attacks.

Contribution evaluation is an important phase in fairness-aware federated learning which provides a significant basis for client selection and incentive distribution. However, most existing contribution evaluation schemes have been proposed without considering privacy protection, which will directly cause privacy attacks and affect the clients’ willingness to participate in a federated learning task. To address this issue, we present a privacy-preserving contribution evaluation scheme (PPCE) based on gradient Shapley, arithmetic sharing, shuffling, and asymmetric encryption for fairness-aware federated learning. To be specific, we leverage arithmetic sharing to achieve the reconstruction and utility evaluation of the sub-model which is needed in the gradient Shapley under the premise of privacy protection. Besides, we use shuffling and asymmetric encryption to ensure the privacy of test data which is collected from the participanting clients for the sake of fairness. We also analyze the privacy and security of PPCE. Finally, we prototype PPCE and estimate the performance using classical neural networks and real datasets. The results show that PPCE achieves high performance in terms of computational costs.