<figure><img src="image_1.png" /></figure>

HAL
open science

# Privacy-Preserving Federated Learning

Aftab Akram, Clémentine Gritti, Melek Önen

► To cite this version:

Aftab Akram, Clémentine Gritti, Melek Önen. Privacy-Preserving Federated Learning. Eurecom
presentation 2025, Mar 2025, Sophia Antipolis, France. 2025. hal-05127285

HAL Id: hal-05127285

https://hal.science/hal-05127285v1

Submitted on 24 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

## Federated Learning (FL)

### Overview

<figure><img src="image_4.png" /></figure>

### Privacy & Security Requirements

* Local model privacy

- Threats:

* Membership Inference attack (MIA)

* Data property inference attack (DPIA)

* Aggregate integrity

- Threats:

* Global model degradation

* Aggregate forgery

* Robustness

- Threats:

* Data poisoning

* Model poisoning

* Non-IID settings

- Threats

* Inaccurate model

* Client dropouts

### Secure Aggregation for Model privacy

### Secure Aggregation

#### Encryption-Based

#### MPC-Based

Masking

Additively
Homomorphic
Encryption

Functional
Encryption

Secret Sharing

<figure><img src="image_5.png" /></figure>

Simple operations

Long-term keys

User dynamics

No key setup

<figure><img src="image_6.png" /></figure>

Online setup

User dynamics

Online TTP

High communication overhead

## Robust Blockchain-based Federated learning

[ICISSP'25]

### Privacy, Integrity and Byzantine Attacks

### Building Blocks

<figure><img src="image_7.png" /></figure>

* Blockchain for model integrity

<figure><img src="image_8.png" /></figure>

- Client sends
    encrypted input

- Validators Perform
    required computation

<figure><img src="image_9.png" /></figure>

<figure><img src="image_10.png" /></figure>

<figure><img src="image_11.png" /></figure>

- Encrypted output
    and contract state
    recorded on-chain

- Validators reach consensus
    on the result of computation

* TEE for SA

<figure><img src="image_12.png" /></figure>

Encrypted data

<figure><img src="image_13.png" /></figure>

Smart Contract

Secure Enclave

<figure><img src="image_14.png" /></figure>

Encrypted Result

SA inside Trusted Execution Environment (TEE)

* Byzantine-Robust Aggregation

<figure><img src="image_15.png" /></figure>

<figure><img src="image_16.png" /></figure>

Smart Contract

## SAAFL: Secure Aggregation for Label-Aware Federated Learning

[under submission]

### FL with non-IID data - FedLA

<figure><img src="image_17.png" /></figure>

### Our solution - SAAFL

<figure><img src="image_18.png" /></figure>

* Online clients encrypt nonzero value for the dropout and non-selected clients.

### Experimental results

<figure><img src="image_19.png" /></figure>

* FedAvg is not ideal for non-IID data.

* Zero-values for dropout clients (FedLA-FTSA) fail in FedLA.

* SAAFL achieves accuracy comparable to FedLA.