# Blockchain-based Approaches for Secure Federated Learning

Lucas Airam Castro de Souza, Gustavo Franco Camilo, Gabriel Antonio

Fontes Rebello, Lucas Chagas de Brito Guimarães, Miguel Elias Mitre

Campista, Luís Henrique Maciel Kosmalski Costa

► To cite this version:

Lucas Airam Castro de Souza, Gustavo Franco Camilo, Gabriel Antonio Fontes Rebello, Lucas Chagas de Brito Guimarães, Miguel Elias Mitre Campista, et al.. Blockchain-based Approaches for Secure Federated Learning. BRAINS 2024 - 6th Conference on Blockchain Research & Applications for Innovative Networks and Services, Oct 2024, Berlin, Germany. hal-04739271

HAL Id: hal-04739271

https://hal.science/hal-04739271v1

Submitted on 16 Oct 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
Blockchain-based Approaches
for Secure Federated Learning

Lucas Airam C. de Souza¹,², Gustavo F. Camilo¹, Gabriel Antonio F. Rebello¹,³,⁴,

Lucas C. B. Guimarães¹, Miguel Elias Mitre Campista¹,

Luís Henrique Maciel Kosmalski Costa¹

Universidade Federal do Rio de Janeiro (GTA/Poli/COPPE), Brazil

²École Polytechnique, INRIA Saclay

³Sorbonne Université, CNRS, LIP6, F-75005 Paris, France

⁴Instituto de Pesquisas Eldorado, Brazil

*Abstract*—In federated learning, different clients can contribute to the learning process without disclosing private information. Nevertheless, other security issues do still exist. Malicious users can delay the convergence or even degrade the final global model by injecting untrained models. This paper integrates blockchain technology with federated learning and evaluates the performance based on small committees. Based on real experiments, we show that registering all model updates in blockchain introduces system auditability without impacting the federated learning performance.

Keywords: *Federated Learning*; *Blockchain*; *Data privacy*.

# I. INTRODUCTION

In federated learning, multiple participants contribute to the learning process without disclosing private information. Each participant locally trains a pre-established model, typically a neural network, and shares the model parameters instead of personal data. Despite the effort to enhance privacy using federated learning, a system that relies on the cooperation of multiple parties becomes an invitation for malicious actions. Hence, malicious participants can target the model convergence and its final performance instead of participants' private information. For instance, in a typical client-server setting, the aggregation server can maliciously act to harm clients' classification models. Also, malicious clients can send fake updates to degrade the global model classification performance. Besides delaying the final model convergence, malicious actions can benefit a participant interested in poor classification. Consequently, integrating federated learning with blockchain is a promising approach to fill an existing gap in security [1].

Existing work on secure federated learning focus on game theory instead of blockchain-based solutions. Zhan *et al.* survey the current literature on incentive mechanisms for federated learning [2]. Incentive mechanisms motivate clients to use their computational resources to reliably and actively participate in the learning process. The authors classify incentive mechanisms as driven by clients' data contribution, reputation, and resource allocation.

<figure><img src="image_2.png" /><figcaption>Figure 1. Secure federated learning architecture with four clients: three legitimate and one malicious. After the instant *t*, the Malicious Client contributes to the training process by injecting a poorly trained model. This action jeopardizes the global model accuracy, as observed in the hypothetical curve at the top right. Federated learning uses a blockchain to register all local model uploads, including those sent by the Malicious Client. Hence, blockchain auditability can reveal later the actions of the Malicious Client.</figcaption></figure>

Drungilas *et al.* [3] discuss blockchain-based solutions for enhancing federated learning security. Also, they propose to implement the global model in a smart contract and compare its latency to a centralized oracle service. Ali *et al.* [4] discuss in their survey how blockchain and federated learning enhance privacy in IoT environments. Nevertheless, there is a lack of discussion about federated learning with blockchain system requirements and metrics, such as blockchain latency and storage consumption, which we cover in the present paper. These metrics allow designers to estimate the system's performance in real-world scenarios and verify if it meets the minimum requirements.

Unlike previous work, we investigate the use of blockchain technology to secure federated learning environments and provide an evaluation of the system as a whole. Thus, our contribution is three-fold:
* We discuss security vulnerabilities in current federated learning approaches and the blockchain technology contribution to solve them;

* We present state-of-the-art blockchain-based solutions for secure federated learning. We qualitatively compare each approach, describing their blockchain environment, security, reward mechanism, and their FL classification;

* We develop and implement a proof-of-concept blockchain-based application for secure federated learning. We also present a practical evaluation of federated learning latency requirements and blockchain integration overhead into federated learning.

## II. BLOCKCHAIN-BASED FEDERATED LEARNING PROPOSALS

Blockchains can be integrated into federated learning to replace the central aggregation server or to register the history of model updates between the aggregation server and the clients. We organize this section to emphasize these two common approaches.

### A. Aggregation server replacement

Kalapaaking et al. [5] propose a federated learning system that combines Secure Multiparty Computation (SMPC) with blockchain. The proposal protects federated learning model training by aggregating the model updates through SMPC-based scheme between the blockchain and the clients. The blockchain stores the global model in every epoch, enabling model auditability.

Jiang et al. propose the blockchain as a mechanism to verify model updates and establish a reputation system, Blockchain and Federated Learning for Sharing threat detection models as Cyber Threat Intelligence (BFLS) [6]. The reputation system prevents nodes that have malicious behavior from participating in new rounds of federated learning training or at least reducing their contribution to the global model. The authors assume a cross-silo scenario where organizations hold private data. These private data are used to verify malicious updates by computing the model accuracy for each epoch and updating nodes' reputations. Finally, the smart contract aggregates well-behavior users' models according to their score.

TrustBCFL [7] is a method to aggregate the federated learning models securely and also correct the data biases. The proposal consists of a committee-based consensus mechanism for local model filtering in federated learning. The authors propose a scoring method based on the Local Intrinsic Dimension (LID) at the data level to evaluate clients' datasets in federated learning. Also, TrustBCFL establishes a validation committee to perform decentralized validation of the LID values of the models uploaded by trainers. Only training clients with high LID values can be approved by the validation committee. Furthermore, the aggregation clients are responsible for model aggregation and updating the global model.

### B. Model update history

Fan et al. [8] propose an authentication mechanism for federated learning users called Decentralized and lightweight Anonymous authentication scheme for Federated Learning (DAFL). The proposal stands to establish users' identities during federated learning training to guarantee model update integrity, non-repudiation of users' local models, and privacy of the authentication process. DAFL achieves these properties by using Directed Acyclic Graph (DAG) technology to register users' information such as identity and local model updates.

BlockFLA [1] adopts blockchain in federated learning and employs smart contracts to detect participants' misbehavior. The authors proposed a detection algorithm, even though BlockFLA allows plugging in different ones. They assume that verifiers have clean data samples, gradient updates from users, and are aware of the pattern used by attackers to poison data. Thus, verifiers can estimate the model updates and calculate the attribution importance parameter by computing the empirical Fisher Information Matrix (FIM). Finally, the verifiers can measure users' updates and define if the backdoor parameters are high to classify them as an attack attempt or normal update. The authors use two blockchains in the architecture, a private blockchain for federated participants' auditability, and a public blockchain to reward the contribution. The private blockchain stores the model updates calculated by the server and the clients. The public blockchain stores the hash of the parameters sent on the private blockchain and executes a smart contract to detect participants' misbehavior. Misbehavior detection is based on the established identity in the private blockchain.

In another work, De Souza et al. present DFedForest [9], which uses decision trees created by different domains to generate a federated random forest as an alternative to traditional federated learning. They define each domain as a participant in the cross-silo federated learning scenario. Decision tree models are stored on a private blockchain, allowing other domains to audit the training process. In their proposal, each domain maintains a local forest, queries the blockchain for new decision tree models, and chooses whether to add a model to their local forest. As DFedForest adopts a private blockchain, malicious participants can have their credentials revoked if other participants detect misbehavior in the shared models.

## III. FEDERATED LEARNING AUDITABILITY USING BLOCKCHAIN

The blockchain is a disruptive innovation known for its applications in cryptocurrencies such as Bitcoin [10] and Ethereum. The primary function of a blockchain is to allow distributed transactions between participants without mutual trust. A collective agreement of the involved participants, i.e., a consensus procedure, replaces the use of a trustworthy entity. Although blockchains were initially applied to transfer digital assets, they have been currently deployed in different
use cases due to the advent of smart contracts. These contracts decouple the transaction logic from the blockchain structure, allowing the diffusion of Distributed Applications (DApp).

The data structure is built in a totally decentralized fashion through a peer-to-peer network using the gossip protocol for message dissemination. Nodes are identified in the network by their cryptographic keys or data derived from them. The information shared in the network, new blocks and transactions, are signed using asymmetric cryptography, making it impossible for a node to deny its authorship in generating the message. These properties are essential in federated learning, as a malicious client will not repudiate a biased model update sent to the aggregation server.

In our implementation, the transactions record only a hash of the model and a reference to its model parameters. The model parameters need to be stored off-chain, since blockchains linearly grow according to the number of issued transactions. Therefore, the reference stored in the blockchain points to the model destination, while the hash guarantees its integrity. We only store this information in the blockchain and assume that based on the model's update, a set of verifiers evaluate if there is malicious behavior in the user update. The evaluation may consider different approaches, such as identifying stored models with a different hash, malformed model, or model accuracy after the user update. Each client has a ledger copy and can act as a verifier in the system. Finally, we use a permissioned blockchain to guarantee that malicious participants can be banned from the system.

## IV. IMPLEMENTATION AND PERFORMANCE EVALUATION

Our prototype uses the CIFAR-10 dataset to train and test the models. We perform the experiments on an Intel i7-8700 CPU 3.20 GHz server with six cores units and 32 GB of RAM. Our results plot average values with vertical lines of 95% confidence intervals.

<figure><img src="image_3.png" /><figcaption>Figure 2. Accuracy evolution among global rounds. Based on this result, we assume that 100 global rounds are enough for global model convergence in our scenario.</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Figure 3. Impact of different transaction sizes for four clients issuing 100 transactions simultaneously.</figcaption></figure>

The distributed environment was developed with the open-source platform Hyperledger Fabric 2.0 for the blockchain, with virtualized nodes through Docker v19.03.5 containers. The blockchain uses the Raft consensus protocol, and each block has 100 transactions, as used in previous work on the performance evaluation of the Hyperledger Fabric platform [9]. Hyperledger Fabric is an open platform, easily programmable, without any currency or cost associated with the implementation of permissioned blockchains for organizations. The organizational aspect of Hyperledger meets the multi-domain scenario of cross-silo federated learning, in which companies share updates of machine learning models. The blockchain has two types of nodes: orderers and peers. Nodes are associated with network organizations, which represent domains. Peers are responsible for interacting with the blockchain and issuing, validating, and verifying transactions. Orderers verify the peers' signatures, establish the order of transactions within blocks, and publish blocks to the network. The system considers transactions with unknown or revoked signatures to be invalid.

We divide the experimental process into two phases: blockchain transaction confirmation overhead and federated learning latency requirements. The goal of the first experiment is to show that the latency added by the blockchain is insignificant, confirming that the blockchain does not represent a bottleneck for federated learning systems. The second experiment analyzes the latency convergence of federated learning. We compare the results obtained in the first experiment with the second experiment that evaluates the blockchain overhead.

Before executing the experiments of latency requirements, we estimated the number of rounds needed for the model convergence in federated learning in our scenario. Figure 2 exhibits the model accuracy as a function of the number of training rounds. We then determine that 100 training rounds are sufficient for model convergence.

### A. Blockchain latency overhead

In the first experiment, we evaluate the scenario proposed by the authors of [9], where clients are associated with Hyperledger Fabric organizations to form committees. We propose two evaluation scenarios. Our first scenario consists of only one client sending transactions, while our second
scenario is composed of four clients sending transactions simultaneously.

Figure 3 evaluates the scalability of the committee. The results show that with four clients sending 100 transactions concurrently, the system throughput is in the interval of [13, 16] transactions per second, according to the model size, since it takes approximately 6.25 seconds to issue 100 transactions. Previous works show that Hyperledger Fabric can scale to thousands of transactions per second [11]. Based on our results, we conclude that on-chain storage of the models imposes system performance degradation, and off-chain storage can improve the blockchain throughput, reducing transaction size [9]. Thus, systems that combine federated learning and blockchain should avoid the on-chain overhead. Reducing such overhead is possible by only publishing in the blockchain hashes and off-chain references to provide model auditability and ensure security.

## B. Federated learning latency requirements

We evaluate the requirements of a blockchain-based federated learning system according to the hyperparameter of local rounds. We execute experiments with three different values of local rounds [1, 10, 20]. The first value establishes the minimum latency required to register a model update, whereas the other two are commonly-used values in federated learning configurations. Figure 4 exhibits the results of our second experiment.

<figure><img src="image_5.png" /><figcaption>Figure 4. Time to execute a total of 100 global rounds for different local rounds configurations. The results show that a client sends an update message to the server in the interval of [500, 1000] milliseconds on average.</figcaption></figure>

The results show a client sending an update message to the aggregation server in the interval of [500, 1000] milliseconds on average. Note that to send 100 messages, the client needs [50, 100] seconds. In a real scenario, however, these values may alter according to the deep neural network topology and the clients' dataset size. The hyperparameter of local rounds in our evaluation presents little effect on the total convergence time. These results, however, strongly rely on other conditions, like training sample size and model architecture. Smaller datasets imply faster local updates, increasing the blockchain throughput requirements.

Based on the results of the second experiment, we can affirm that blockchain supports committees of hundreds of clients per organization on the Hyperledger Fabric platform

without imposing high delays for communication. The scalability, however, can be improved by optimizing blockchain storage utilization.

## V. CONCLUSION

Federated learning is a promising paradigm for user privacy guarantees. The blockchain can effectively improve federated learning security in model sharing, secure aggregation, or even in logging partial models. Also, blockchain-based federated learning systems can establish trust among participants, enabling auditability and automatic rewards systems through smart contracts. We integrate federated learning with a blockchain network and evaluate a scenario based on small committees. We prove that local computations of model updates, on average, take more time than sending transactions to the blockchain, proving that blockchain is not the system bottleneck. Our results show that committees can effectively scale for hundreds of clients. Nevertheless, there is a lack of proposals and evaluations with cross-device scenarios with thousands of devices.

## ACKNOWLEDGMENT

This work was financed by CNPq; by Coordenação de Aperfeiçoamento de Pessoal de Nível Superior Brasil (CAPES), Finance Code 001; FAPERJ Grants E-26/203.211/2017, E-26/202.689/2018; and Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP), Grants 15/24494-8, 18/23292-0, 2015/24485-9, and 2014/50937-1.

## REFERENCES

[1] H. B. Desai, M. S. Ozdayi, and M. Kantarcioglu, "BlockFLA: Accountable Federated Learning via Hybrid Blockchain Architecture," in *Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy*, 2021, pp. 101–112.

[2] Y. Zhan et al., "A Survey of Incentive Mechanism Design for Federated Learning," *IEEE Transactions on Emerging Topics in Computing*, 2021.

[3] V. Drungilas et al., "Towards Blockchain-Based Federated Machine Learning: Smart Contract for Model Inference," *Applied Sciences*, vol. 11, no. 3, p. 1010, 2021.

[4] M. Ali, H. Karimipour, and M. Tariq, "Integration of Blockchain and Federated Learning for Internet of Things: Recent Advances and Future Challenges," *Computers & Security*, p. 102355, 2021.

[5] A. P. Kalapaaking, I. Khalil, and X. Yi, "Blockchain-based Federated Learning with SMPC Model Verification Against Poisoning Attack for Healthcare Systems," *IEEE Transactions on Emerging Topics in Computing*, 2023.

[6] T. Jiang, G. Shen, C. Guo, Y. Cui, and B. Xie, "BFLS: Blockchain and Federated Learning for sharing threat detection models as Cyber Threat Intelligence," *Computer Networks*, vol. 224, p. 109604, 2023.

[7] S. Zhou, K. Li, Y. Chen, C. Yang, W. Liang, and A. Y. Zomaya, "TrustBCFL: Mitigating Data Bias in IoT Through Blockchain-Enabled Federated Learning," *Internet of Things Journal*, 2024.

[8] M. Fan, Z. Zhang, Z. Li, G. Sun, H. Yu, and M. Guizani, "Blockchain-based Decentralized and Lightweight Anonymous Authentication for Federated Learning," *Transactions on Vehicular Technology*, 2023.

[9] L. A. C. de Souza, G. A. F. Rebello, G. F. Camilo, L. C. Guimarães, and O. C. M. Duarte, "DFedForest: Decentralized Federated Forest," in *2020 IEEE International Conference on Blockchain*, 2020, pp. 90–97.

[10] S. Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System," *Decentralized Business Review*, p. 21260, 2008.

[11] C. Gorenflo, S. Lee, L. Golab, and S. Keshav, "FastFabric: Scaling Hyperledger Fabric to 20 000 Transactions per Second," *International Journal of Network Management*, vol. 30, no. 5, p. e2099, 2020.