Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
Authors: Lang Pu
Jingjing Gu
Chao Lin
Xinyi Huang
Venue: ICML 2025 poster (2025)
Keywords: federated learning
multi-round secure aggregation
privacy enhancement
Primary area: social_aspects->privacy

Abstract: Secure Aggregation (SA) is a cornerstone of Federated Learning (FL), ensuring that user updates remain hidden from servers. The advanced Flamingo (S\&P'23) has realized multi-round aggregation and improved efficiency. However, it still faces several key challenges: scalability issues with dynamic user participation, a lack of verifiability for server-side aggregation results, and vulnerability to Model Inconsistency Attacks (MIA) caused by a malicious server distributing inconsistent models. To address these issues, we propose $\textit{Janus}$, a generic SA scheme based on dual-server architecture. Janus ensures security against up to $n-2$ colluding clients (where $n$ is the total client count), which prevents privacy breaches for non-colluders. Additionally, Janus is model-independent, ensuring applicability across any FL model without specific adaptations. Furthermore, Janus introduces a new cryptographic primitive, Separable Homomorphic Commitment, which enables clients to efficiently verify the correctness of aggregation. Finally, extensive experiments show that Janus not only significantly enhances security but also reduces per-client communication and computation overhead from logarithmic to constant scale, with a tolerable impact on model performance.

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
Lang Pu
Jingjing Gu
Chao Lin 2 Xinyi Huang
Abstract
and directly accessible by the server. However, users are gen- erally unwilling to share their raw data, particularly when it involves sensitive information, such as medical records, photographs, or confidential business information. Feder- ated Learning (FL) (McMahan al., 2017) a distributed learning framework proposed to protect user privacy by en- abling collaborative model training without exposing private data, thus encouraging greater user participation. Unfortu- nately, it has been demonstrated that an adversary can invert single model update to reveal sensitive information about the target user's local dataset (Hitaj et al., 2017; Nasr et al., 2019; Zhu et al., 2019).
Secure Aggregation (SA) is a cornerstone of Federated Learning (FL), ensuring that user up- dates remain hidden from servers. The advanced Flamingo (S&P"23) has realized multi-round ag- gregation and improved efficiency. However, still faces several key challenges: scalability is- sues with dynamic user participation, lack of verifiability for server-side aggregation results, and vulnerability to Model Inconsistency Attacks (MIA) caused by a malicious server distributing inconsistent models. To address these issues, we propose Janus, generic SA scheme based on dual-server architecture. Janus ensures security against up to is the total client count), which prevents privacy breaches for non-colluders. Additionally, Janus is podeel-independent, ensuring applicability across any FL model without specific adaptations. Fur- thermore, Janus introduces a new cryptographic primitive, Separable Homomorphic Commitment, which enables clients to efficiently verify the cor- rectness of aggregation. Finally, extensive ex- periments show that Janus not only significantly enhances security but also reduces per-client com- munication and computation overhead from loga- rithmic to constant scale, with a tolerable impact model performance.
Secure Aggregation (SA) (Bonawitz et al., 2017) designed to enhance privacy by preventing the adversary from access- ing individual update. SA has been regarded as one of the most robust defenses against gradient inversion and infer- ence attacks (Huang et al., 2021). Most existing SA schemes rely on the double-mask technique, which involves time- consuming secret sharing and key agreement. BBSA (Bell et al., 2020) optimizes the communication graph re- duce time-consuming operations and significantly improve overall efficiency. However, it remains limited to single- round aggregation. In contrast, FL typically requires mul- tiple rounds of aggregation to achieve model convergence. Although the protocol can be executed multiple times to support multi muuti-round aggregation, the setup phase must be re-run in each round to maintain privacy. Consequently, the server must interact with all clients every round, leading to heavy communication overhead and reduced efficiency.
colluding clients (where
Recently, the state-of oftt--of-thearr eliminates the re-setup in each round, which supports multi- round SA based on the BBSA. It also optimizes the commu- nication graph to improve the system's performance by intro- ducing a set of decryptors handle part of the computation. A Although Flamingo demonstrates significant advantages in efficiency and functionality, it also has the following limita- tions. Firstly, the complicated setup procedures of Flamingo limit its practicality in dynamic environments where users frequently join or leave. Secondly, the server can exploit the Model Inconsistency Attacks (MIA) (Pasquini et al., 2022), which result from malicious server distributing inconsistent models infer users' local datasets. Lastly,
the-art art Flamingo (Ma et al., 2023)
1. Introduction
Traditional machine learning relies on centralized training, where the entire dataset is stored in single central location
'College of Computer Science and Technology, Nan- jing University of Aeronautics and Astronautics, Nanjing, China *College of Computer and Cyber Security, Fujian Normal University, Fuzhou, China *College of Cyber Security. Jinan Uni- versity, Guangzhou, China. Correspondence to: Jingjing Gu < gujingjing www..adu..co edu.cn.>d......d... Chao Lin < linchao91 @ fjnu.edu.cn>>.
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
Table 1. Comparison of SA Constructions
Scheme
Input Privacy
Multi-round
Verifiability
Dynamie
Versatility
NS
Efficience!
MIA
SecAgg (Bonawitz et al., 2017)
X
X
BBSA (Bell et al., 2020)
x
x
X
VeriFL (Guo al., 2020)
X
X
ELSA (Rathee et al., 2023)
X
X
X
2
X
Flamingo (Ma al., 2023)
X
2
X
Janus
Support, X No support. Versatility: A generic construction. * Number servers. t The decryptors this construction can be abstracted to a server. $ More black parts in the circle indicate better efficiency, and the theoretical support comes from the computation efficiency analysis in Table 2.
users cannot verify if the server correctly performed the aggregation or omitted data.
the practical willingness of institutions to cooperate for SA.
However, the dual-server architecture still faces the same challenge as Flamingo: the inability to efficiently verify the aggregation results. Specifically, malicious server may perform incorrect collection aggregation of masked gra- dients masks. The server may choose faster but less accurate computations to save resources, which can result in incorrect aggregation results. Since servers are often semi-trusted, they could also deliberately mishandle some gradients or falsify aggregation results, mislcading users about the training results (Hahn et al., 2021). Most existing schemes achieve verifiable aggregation through homomor- phic hashing and homomorphic signatures (Guo et al., 2020; Xu al., 2019). However, these time-consuming operations introduce significant overhead to the system, resulting in low efficiency. Moreover, errors in aggregation could arise from malicious client submissions, yet current methods fail to enforce strong client-side commitments.
MIA stems from the reliance on a single server, which is common due to its simplicity. The single-server architecture inherently has access to the aggregated results, thereby ex- posing the system to potential MIA (Pasquini al., 2022). Specifically, the server distributes carefully crafted parame- ters to non-target users, which can trigger the bying-ReLL effect that causes non-target users to generate zero gradients during aggregation. As a result, the aggregated gradient effectively reveals the target user's gradient. This attack affects not only double-mask schemes but also all schemes in which the server has access the aggregation results. Cryptographic signatures can prevent this by allowing users to verify the consistency of received aggregated models. However, they incur heavy computation and require users to negotiate the consistency of the received information, placing large burden on the system.
Fortunately, our research indicates that preventing MIA re- quires limiting the server's access to the final aggregation re- sults. To achieve this, we propose dual-server architecture: one server handles the collection and aggregation of masked gradients, while the other manages the aggregation all masks. Our method ensures the privacy of non-collude collollu users remains uncompromised, even in the presence of col- lusion between the servers and up to n 2 users, where n is the total number of users. The malicious server has access only to the aggregated ciphertext of two uncolluding clients, which prevents the extraction of individual gradients. If single server were compromised, individual privacy would remain intact due to the secure cryptographic primitives that prevent unauthorized access to private data.
To address these challenges, we introduce a new crypto- graphic primitive called separable homomorphic commit- ment (SHC), which ensures both server-side integrity and client-side data accuracy in the dual-server setting, Specifi- cally, our main contributions are summarized as follows.
Firstly, Janus is the first generic construction of SA based dual-server architecture, which is well- suited for multi-round aggregation in FL without time- consuming re-setup. By requiring only the servers' public keys, our design climinates the overhead associ- ated with heavy communication graphs, such as com- plete graphs or k-regular graphs. Additionally, Janus relies on lightweight components, which significantly improves system efficiency.
The dual-server assumption is feasible in real-world contexts involving entities with different interests, such as banks and other financial institutions, hospitals and other healthcare organizations. They are motivated to collaborate for the ben- efit of users and avoid collusion. Similarly, in the Flamingo scheme, the decryptors can also be regarded as one server, forming a dual-server architecture together with the aggrega- tion server. This approach ensures security while leveraging
Secondly, the conceptual development of new cryp- tographic primitive (SHC) for dual-server architec- ture to jointly achieve verifiability and enhance pri- vacy. SHC is homomorphic commitment scheme that supports the separation of messages and random components. ensures that aggregation results remain invisible to servers, preventing malicious servers from launching MIA. Additionally, we identify a blueprint
2

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
that SHC can be instantiated provide novel verifica- tion methods for aggregation results.
Binding. After the commitment is made, the committer cannot change the committed value. It can prevent the committer from cheating by ensuring the immutability of the commitment. There exists a negligible func- tion negl(A) such that for all non-uniform Probabilistic Polynomial Time (PPT) adversaries A.
Lastly, we implemented an instantiation for Janus and evaluated it with similar classical schemes via exten- sive experiments
different models and datasets. The results show that Janus outperforms in terms of both computation and communication. It reduces per-client overhead from the logarithmic scale of current advanced methods to a constant scale. Ta- ble 1 demonstrates that Janus surpasses other state- of-the-art schemes in terms of security, efficiency, and functionality.
CSetup(11) - pp;
A(pp) + (c, 21, 02)
Pr
Reveal (pp, (pp, C, 01, = 1A
S nnegl(A). (3)
Reveal (pp, U2, = 1A
1 + U2
2. Preliminaries
2.2. Masking-based Secure A Aggregation
2.1. Traditional Cryptographic Commitments
The One-Time Pad (OTP) a type of classical encryption that achieves perfect secrecy (Katz & Lindell, 2014). Specif- ically, a formal OTP scheme usually contains the following main algorithms.
Commitments (Pedersen, 1991) provide the cryptographic comerstone for integrity and trust in various secure schemes. It enables participants commit to values without compro- mising the underlying confidential information. Typically, a non-interactive secure commitment scheme consists of the following three algorithms.
(1) Masking(z, A) â. The masking algorithm takes as input secret message x and a private key k and out- puts the encryption result á.
(I) CSetup(1^) + pp. The system initialization algo- rithm takes as input security parameter and outputs the public parameter pp for the commitment scheme.
UnMasking k)- x. The unmasking algorithm takes input an encrypted message & and private key k. and outputs the plain message r.
(2) Commit(pp, v, r) - c. The commitment generation algorithm takes as input message from the message space Mpp and random number (blinder) in the randomness space Rpp. and outputs the commitment in the commitment space Cpp-
SA is designed prevent centralized servers from accessing individual updates. Due to its simplicity and efficiency, OTP is commonly used in mask-based SA for FL. Users apply OTP-based masking to their updates before uploading to the central server. There are several variants of SA to address different threat models and system requirements. We focus on masking- based aggregation schemes (Bonawitz al., 2017). Specifically, let Ud be set of users, where each user " E lI holds private update 24. In masking- -based SA, each u, adds pair-wise additive mask to get the masked vector y/ as follows.
(3) Rpveal(pp, v, r) -> b. The revealing commitment algorithm takes input a message v, a commitment c, and blinder r. If it accepts, then the output b 1; otherwise, 6 0.
Normally, secure commitment scheme must satisfy the following three properties.
Completeness. It ensures that if both the committer and the verifier follow the protocol correctly, the verifier will always accept the decommitment (Reveal).
Σ PRG() By ayElaej
Σ PRG(s (4) MyEMa>>]
y: x
CSetup(1>) - pp: Commit(pp, v, -> c; Reveal(pp, r. =
where the pseudorandom generator (PRG) can randomly generate sequence number based the random seed stj. Note that the masks will be removed when all masked input updates Y, = Em u Yi are aggregated as follows.
Pr
1
Hiding. During the commitment phase, the verifier can- not infer the committed value from the commitment. It can ensure that the committed value remains confiden- tial until it is revealed. For any U1, U/ of equal length, and any r, the following probability distributions are computationally indistinguishable.
Y= Σ (xr + PRG(.1)) Σ PRG(s,.)). (5)
u.Eu
Obviously, we have Y Eu,ey Zz. To deal with dropped users during the execution, the Shamir secret shar- ing scheme (Shamir, 1979) is used to share seeds among all users. The Diffie-Hellman (DH) key exchange proto- col (Diffie & Hellman, 1976) is used to negotiate the seeds
[Commit(pp, v1, r) + e1} &
[Commit(pp, r) + oz).
3

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
Si for each pair of users (u, my) E U. Note that for large- scale FL. applications, the above scheme is not effective. For n-user FL system, it takes Onn²) communication rounds to run the pairwise DH key exchange protocol.
system, which are the aggregation server Sy. the assistant server Si, and users. We assume that each user Ui. E U holds private update zi, of dimension m. For simplicity, we assume that the elements of 24,0 and Eu,,,,, Zi, are in Z for R.
2.3. Model Inconsistency Attacks
3.1. Separable Homomorphic Commitment
At high level, Model Inconsistency Attack (MIA) (Pasquini et al., 2022) works by sending a correct model to the target user while distributing crafted ones to non-target users. These crafted model parameters are designed to suppress non-target users' contributions, effectively driving their next-round updates to zero. As a result, the aggregated model primarity reflects the target user's update, breaking the privacy guarantees of SA. Formally, a malicious server A intends to obtain raw data about the model update of target user Utar,e. It can elaborately distribute constructed parameters 0i, to the non-target users {u) \ Utarre) and then send normal parameters fiors the target user, where 0,. * 0rar. and U denotes the set of all users. This can trigger the dying-ReLU (Lu et al., 2019), where the dead layer cannot generate any gradient. Therefore, the non-target user ends up generating tampered model updates f2.. A where the D is the local data of U... Since the parameters of Utor. are real, it generates a valid update A Puun. Diar. on its local data Diar. in round t. These tampered model updates enable A to obtain the model updates A Star.. of Ütar; in plaintext. Specifically, the final result of SA (denoted as 3) is as follows.
Definition 3.1. (Separable Homomorphic Commitment, SHC). We define a secure SHC scheme as a cryptographic protocol that enables secure and flexible commitments. It consists of a set of algorithms denoted by a tuple of (Setup, Commit, Se, PCommit, Reveal). The formal syntax of each algorithm is described as follows.
(1) Setup(1>) + pp. A PPT initialization algorithm takes as input a security parameter X, and outputs a public parameter pp.
(2) Commit(pp, m,,) r) + c. A PPT commitment algo- rithm takes as input a public parameter pp, a message m, and random number r, and outputs a complete commitment (Cm: Cr), where Cm is associated with m and or is related to the random number (blinder) r. (3) Se(pp, e, G)) + Cm- A Decisional Polynomial Time (DPT) separation algorithm takes as input a public parameter pp, a complete commitment c, and a blinder- related part Cy, and outputs the message-related com- mitment Cy--
(4) PCommit(pp, m) - Cm- A DPT commitment algo- rithm takes as input public parameter pp, a message m, and outputs the message-related commitment Cm-
A (A Pid Bi : A Olana B:11. D
Drang" Diti, A
Onn
Dine!
= AA 0, A Dear.e"
Orant O 0)-
Orarse Deana"
(6)
(5) Reveal(pp, c, m, r) + {1/0}. A DPT revealing com- mitment algorithm takes as input the public parameter pp, the complete commitment c, the message m, and the random blinder r, and outputs 1 if the is the valid committed message of e and 0 otherwise.
Once A gets the update A Ounnd Deanie it can get sensitive infor-
mation about Diar.: by executing gradient inversion attacks or inference attacks.
The SHC can separate the message-related part and com- pare it with the aggregated results to ensure the correctness of the aggregation. Therefore, two servers independently aggregate the different components of the commitments in the following Janus. In addition to the completeness, binding, and hiding properties of traditional commitment schemes discussed in Section 2, SHC offers the following two additional properties.
3. Methods
Notations. In this section, we design Janus, generic privacy-enhanced multi-round SA scheme through dual- server architecture, where SHC is the core cryptography for verifiability. To facilitate understanding, we first present a new primitive SHC, followed by elaborating on the con- struction of Janus. Let O denote the consecutive operation of @. Specifically. Oi 24- I1 O Zz... @ Zy. where the indicates addition or multiplication depending on the specific scheme. T is the total number of rounds required for the model to converge and / denotes the current round. Let n users participate in the FL training, where users are denoted by U4 = (U.,, i E n1]] All users negotiate a model architecture and train the model locally on their private data sets D.,.- There are three types of entities in our
Separability. The complete commitment can be di- vided into two parts (Cm. G)), where Cm is the part associated with the commitment message m and e, is related to the random blinder r. It can use c, to extract from the complete commitment e only the part that is relevant to m. Taking the classic Pedersen commit- ment (Pedersen, 1991) as an example, the complete
4

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
commitment is c h"gg.. Given 4. h², Cm g" Cm can be computed through e/c,- Furthermore, the Cm can be calculated through PCommit(m, pp) gmh
Users
Sp
R Masking( cy - Enc(pk,.sk.j skky)
(ep 92) + Commin(AAa)
where g is public parameter.
(
(9
Homomorphism. Homomorphism plays a key role in enabling secure aggregation. Define the space of message and blinder Mc. Re respectively. For v(mo, ro), (m), E MM, Re. we have
8 = 0 &a
(F.C))
C, = 00 Rrr
sk, Dec(sk, CT,e
SK; 01-1skp.
(SKg G2)
G 0 fir
X, UnMasking(&,
Co + m1:r0 rr) Commit(mo;ro)) Commit ro
Ge GT
(7)
Gi PCommil(X...99)
Ca
SHC's flexible design not only supports SA in FL but also enables seamless adaptation to a wide range of applications that demand both privacy and verifiability. These applica- tions include, but are not limited to, the following scenarios: (I) medical data federation where SHC enables verifiable auditing; (2) dual-server e-voting systems needing verifi- able tallying; and (3) secure outsourced computation with input/output validation.
Figure I. The Workflow of Janus. So is the aggregation server and S1 is the assistant server. It is worth noting that Sp and S1 do not need to interact throughout the process.
values, ensuring verifiability. In addition, its binding prop- erty prevents users from denying previously sent malicious messages when subsequent misbehavior is detected. This is feature not available in other advanced schemes. Given the hiding of the SHC and the confidentiality of public key encryption, neither S, nor S can access the received secret information. Combined with our dual-server architecture, higher security can be achieved.
3.2. The Proposed Janus
Janus tackles the challenges of dynamic user participation, verifiability, and resistance to MIA that are not addressed in the state-of-the-art Flamingo (S3P') Specifically, it has the following three key high-level technical ideas:
Figure 1 shows the workflow of Janus. Subsequently, we provide a detailed description of Janus, noting that it is generic construction. Thus, we assume the underlying public key encryption scheme is I (Setup, KeyGen, Enc, Dec), the OTP scheme is II = (Masking, unMasking). and the SHC scheme is Iīş (Setup, Commit, Se, PCommit, Reveal), in which the setup parts of these schemes are completed in the Setup phase of Janus by default. Furthermore, Appendix B presents the tasks of each entity in different phases and provides an instantiation of the generic scheme to demonstrate its practicality. Specifically, Janus consists of the following four phases.
(1) Dual-server architecture and dynamic user participation. Janus involves two servers, So and Sj. Server So is respon- sible for aggregating the masked updates, while server S handles the aggregation of values associated with the com- mitments. The dual-server architecture prevents the servers from accessing the final aggregation results, thus effectively avoiding attacks such model reversal and MIA, which are serious privacy leakage in traditional single-server. Furthermore, there is no need to re-establish complex com- munication graphs when users join or leave. New users can participate in the new training process by simply generat- ing their own public/private keys and obtaining the servers' public keys.
(1) Setup. The objective of this phase is determine the public parameters pp and specific cryptographic schemes, which ensure that subsequent schemes work properly. All participants are given the security parameter A. Then the public parameters pp are generated based on X, including those used in the setup phase and public parameters gener- ation in IT Io, Ils. Each user will generate their private keys sky, for the OTP. Server S will generate its pub- lic/private keys (pk,, sk,) and publish its public key to other participants. Subsequent communications between the users and the servers are encrypted with their respective public keys by default.
(2) Lightweight components and efficient aggregation.
Janus removes the requirement for users to share masking values with neighhors and avoids the costly peer-to-peer key negotiation required by the advanced Flamingo and BBSA. Instead, it applies OTP to mask the updates and encrypts the masking values through lightweight public key encryption. Then, each user only needs to send one message to So and one to 51, respectively. As result, regardless of the number of users in the system, the computation overhead on each user remains constant.
(3) Verifiability and privacy enhancement. The separabil- ity of SHC enables users to locally validate the aggregated
(2) Masking and Report. Us. masks its local update Tt,t through Masking (ai,ing( sks,e) to get the masked update
5

---

Janus: Dual-Server Secure Aggregation with Verifiability for Federated Learning
Table 2. Comparison of Performance Analysis
Computation
Communication
Scheme
Clical
Server
Clicut
Server
SecAgg (Bonawitz et 2017)
O(1 - md)
Oldie))
Oin m)
Ole" + mn)
BBSA (Bell et al., 2020)
O + (A)
(n([AP + (A))
01 +
Din(4P 0)
VeriFL (Guo al,, 2020)
O6s)
O(++
O(n)
0(1)+ O(1)
ELSA (Rathee al., 2023)
O + ()
((++nl)
0(1)
R: OiI.2)
R: Olt + 4 1.2)
Flamingo (Ma et al., 2023)
O(n + 12)
O + +1 L+) Al)
D: OIL dAn + (1 +nn+
D: 0(2 + L 6An + (1 8)m)
Janus
D(1 ())
O(e 1 ud)
0(1)
(())
* Let n, L, A denote the total number of clients, the number of decryptors, and the upper bound number of neighbors of a client, respectively, where A = log n BBSA. I denotes the dimension of the update. denotes the dropout rate, respectively. e is the parameter of graph generation. R and D denote regular client and decryptor, respectively.
Fi.-- Subsequently, U2, encrypts the ski,, using the pub- lic key of S1 through Enc(pk,, ski,)) to get the cipher- text CTa,,. To enable subsequent verifiability, U2 gen- erates separable commitment to its local update Fi, using Commit(a,,, Ti,e,, where ra, is random blinder. The re- sulting commitment Ci. can be separated into two parts: (ci,r Ci,m), where Girr is the commitment of blinder; and G.m. is the commitment of local update. Then Ui. sends (di,,; C.rr) to the aggregation server Su and (ci,e, (T,,)) to the assistant server St.
4. Evaluation
4.1. Theoretical Analysis
Janus offers enhanced security compared to state-of-the-art schemes. As detailed in Appendix C, we provide a formal security analysis demonstrating that Janus resistant to MIA and achieves multi-round security. A key advantage of Janus over schemes like Flamingo and BBSA lies in its ability to complete each aggregation round with fewer interactions. In these advanced schemes, additional com- munication with neighboring nodes is required to eliminate masks or perform decryption. By contrast, Janus signifi- cantly reduces interaction complexity. Furthermore, given that core operations such as commitments and encryptions are of constant complexity O(1), Janus achieves superior efficiency by maintaining constant interaction count re- gardless of the number of users.
(3) Collection and Aggregation. In this phase, So and S will complete aggregation of users updates. Specifically, So will aggregate the masked input updates from all users via X, = O' computes Cp = O Ci,- = Ct. O C2, O ... O Cr.r. So sends (Xe, C2) to all users. Xe contains the updated ag- gregated values, and C, serves to validate the aggregated result in round t. S1 first decrypts the ciphertext to get the shi,t via Dec(s CTa,)). Then can aggregate the Oi ski, ski,2 O sk2, @ ... O skine = SK,, Fur- thermore, it computes the aggregated commitment value O G. C1a @ C ④ ... @ G2 = C, which enables subsequent users to verify the aggregation performed by So- Finally, S sends (SK,, C,) to all users.
i= Li.t- = d1,t @ f222 .... @ &n.t. Then So
Notably, Janus is designed to be highly client-friendly, with system overhead independent of the number of users-a major limitation of previous schemes. Users only need two interactions with the servers before going offline, min- imizing computation and communication demands. As result, the aggregation process remains robust and accurate, even in the presence of user disconnections or dropouts. To highlight the efficiency of Janus, we focus on single ag- gregation round. A detailed comparison of communication and computation overhead with other advanced schemes presented in Table 2.
(4) UnMasking and Verification. Users compute the final update and verify the aggregated result based on the values received from So and S,. Specifically. Us. gets the final aggregation result through X, = UnMasking(Xx, (X., SKt), where the X, the final aggregation result of the round To verify the correctness of the aggregation result, U extracts the commitment value related to the updates through Cm = Se(Cr, C.). UL. then calculates the commitment value, which is only related to the updates through Cū = PCommit(X; pPc), where the ppc is the public parameter of the underlying SHC. Finally, U compares whether C, and C.,, are equal. If the two values are equal, the aggregated result is accepted as valid. Otherwise, it is rejected, and U terminates the subsequent training.
Computation Cost. The computation cost of each user con- sists of: (1) masking the local update via OTP; (2) encrypt- ing the key of OTP by public key encryption; (3) committing the local update by SHC; (4) unmasking the global aggre- gation result; (5) separating message-only commitments from the full commitment; and (6) calculating the commit- ment value based on the unmasking result and comparing whether it is equal to the separated commitment value to complete the verification. All the above operations take only O(1). Therefore, the computation overhead of each user is constant. The computation cost of Sp mainly consists of
6

---

Janus: Dual-Server Multi-Roun Secure Aggregation with Verifiability for Federated Learning
18
120
340
130
30
120
Dand (CNN))
(a) MNIST (CNN)
(h) CIFAR (CNN)
100
100
DEGA
Duaaci
(c)) MNIST (MLP)
(6) CIFAR (MLP)
(0 CIFAR 100 (MLP)
Figure 2. Test accuracy across different datasets and models.
aggregating the masking updates from users and the com- mitment random numbers, which both take (n). Thus,
GHz processor with 32.0 GB of RAM, a 64-bit Windows 11 operating system, and an RTX 4070Ti GPU display adapter.
the total computation overhead grows linearly with the num- ber of users. For Sj, the computation cost consists of: (1)
Datasets and Models. MNIST consists of 70,000 grayscale handwritten digit images (60,000 for training, 10,000 for testing), each 28x28 pixels. We simulated an environment with 100 users, each holding 600 local training samples. The global model for MNIST is fully connected network with layers of size (784, 256, 10). CIFAR-10 includes 60,000 color images across 10 classes (50,000 training, 10,000 testing), using a CNN architecture with a batch size of 10, learning rate of 0.001, and 100 training epochs. We employed SGD the optimizer, with each user applying SGD once per global epoch.
decrypting the ciphertext of the private key of OTP; (2) ag-
gregating the private keys for masking; and (3) aggregating the complete commitments for subsequent verification of the aggregation result from Sg. All above operations take On). Overall, the overhead of servers grows linearly with the number of clients, which takes (n).
Communication Cost. Each user only needs send one masked message So and one encrypted commitment to St. As result, each user incurs constant communication overhead. So will send the aggregation result of the masking updates to all users, which takes (nn). Si sends both the aggregated OTP key and the full commitment to all users, which also incurs (n) communication overhead. S sends both the aggregated OТP key and the full commitment to all users, which also incurs (n) communication overhead. Overall, the communication overhead on the server side scales linearly with respect to the number of users.
Baselines. We implemented the original FL (No-SA), where the server aggregates plain updates in each train- ing (McMahan et al., 2017). BBSA (Bell et al., 2020) optimizes the communication graph of the first mask- based SA scheme (Bonawitz al., 2017). Meanwhile, Flamingo (Ma et al., 2023) introduces multi-round aggrega- tion; VeriFL (Guo et al., 2020) achieves verifiability; and ELSA (Rathee et al., 2023) improves efficiency of the sys- tem. Additionally, Flamingo. VeriFI, and BBSA are de- signed to wait for messages from at least out n users. handle user dropouts, we reconstruct the communication graph using only the responsive clients, resulting in better performance than the original approach.
4.2. Experiments
To assess the practical performance of Janus, we carried out comprehensive experiments focusing on both effective- ness and efficiency. We further compared it with several representative advanced schemes. Our experimental setup includes a 13th Gen Intel(R) Core(TM) i7-13700KF 3.40
Model Performance. To comprehensively evaluate the impact of the SA on the model training effectiveness, our

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
Same
Sanne
Serme
Jaus
56.95
Jonc
30500
Veri7
Rwvep
N0:55
Jens
1000
FRAL
Pinong
Siheo
Sclenn
(a) MNIIST (CNN)
(b) CIFAR (CNN)
(d) CIFAR 100 (CNN)
30
Iencion
Tool
33
Strvet
12
N0.55
2005
1880
96.95
Jans
3055
Harre
N655
3006
1005
15.55
Pinerge
Sdho
(d) MNIST (MLP)
(e) CIBAR (MLP)
(1) CIEAR-100 (MLP)
Figure 3. Computation overhead across different datasets and models.
experiments are carried out on different datasets and models. We conducted the training with 100 users and compared the test accuracy of our Janus with advanced schemes as shown in Figure 2. The experimental results lead to the following conclusions. The final test accuracy after model conver- gence differs only slightly between Janus and the compared schemes. The No-SA baseline achieves the highest accuracy, with Janus closely trailing. Notably, Janus not limited to specific models or datasets. These results confirm its practicality and effectiveness in preserving accuracy under secure aggregation.
schemes lack this capability. To enable multi-round ag- gregation, we adapted them by repeatedly executing the single-round protocol to simulate multi-round aggregation. Although this approach is feasible, it introduces consid- erable amount of additional computation overhead. This further highlights the advantages of our Janus, which is natively designed to support multi-round aggregation with- out incurring such overhead, thus demonstrating superior efficiency and scalability.
As shown in Figure compare the time overhead of dif- ferent schemes, focusing the completion time for single aggregation round. Note that, given the structural differ- ences between these schemes, the comparison includes only the stages that contribute significantly to the overall time consumption in each case. The computation overhead intro- duced by SA is within practical and acceptable range, demonstrating its practicality in real-world applications. More importantly, Janus incurs significantly lower over- head, particularly on the user side, which enhances overall efficiency. This advantage stems from the use of lightweight cryptographic primitives that avoid costly operations such as secret sharing and Diffie-Hellnn key exchange, thereby reducing the computation burden on users and contributing to its superior performance.
Specifically, on the MNIST dataset, No-SA achieves 94.1 % test accuracy with CNN, while Janus reaches 18%. With MLP, No-SA reaches 85.04 85.04% and Janus achieves 83.95%.
Compared to other SA schemes, Janus maintains competi- tive accuracy. On the CIFAR dataset, No-SA achieves 77.8 77.8% with CNN and 72.8% with MIP, while Janus achieves 75.94% and 71 71.6%, respectively. Janus achieves test curacy close to the No-SA baseline across different models and datasets.
Computation Overhead. Since masking- bassd schemes are vulnerable to user dropouts, we take this into account when implementing BBSA, VeriFL, and Flamingo. Specifi- cally, we simulated 10% user dropout rate. However, the waiting time to handle dropouts is typically much longer due to the complexity and variability of practical environ- ments. Moreover, it is important to note that Flamingo inherently supports multi-round aggregation, while other
5. Conclusion
In this paper, we introduce new cryptographic primitive. termed separable homomorphic commitment. Building on
8

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
this, we propose Janus, generic dual-server multi-round secure aggregation scheme for federated learning. Specif- ically, Janus effectively tackles critical challenges, includ- ing dynamic user participation, verifiability, and resistance to model inconsistency attacks that are not considered in the advanced Flamingo. It significantly enhances security while simultaneously improving system efficiency, notably reducing per-user communication and computation over- head from logarithmic to constant scale with tolerable impact on model accuracy. Both theoretical analysis and experimental evaluations consistently demonstrate its supe- rior performance. Future work may focus on integrating Janus with advanced prreccypres techniques and de- signing secure mechanisms to detect and mitigate user-level poisoning attacks.
preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 1175-1191, 2017.
Bonawitz, K., Salehi, F,, Konečný, J., McMahan, B., and Gruteser, M. Federated learning with autotumed communication--fficene secure aggregation. In 2019 53rd Asilomar Conference on Signals, Systems, and Com- puters, pp. 1222- 1226. IEEE, 2019.
Brunetta, C., Tsaloli, G., Liang, B., Banegas, G., and Mitrokotsa, A. Non-interactive, secure verifiable aggre- gation for decentralized, privacy-preserving learning. In Australasian Conference on Information Security and Privacy, pp. 510-528. Springer, 2021.
Chen, H. and Vikalo, H. Recovering labels from local updates in federated learning. In Proceedings of the 41st International Conference on Machine Learning, pp. 7346- 7372, 2024.
Acknowledgements
The authors would like to thank the reviewers and area chair for their constructive feedback and support to improve this paper. This work was supported in part by the National Natural Science Foundation of China under Grant 62425205, Grant U21 A20466, and Grant 62372108.
Corrigan Borigan--Gibbs. H. and Boneh, D. Prio: Private, robust, and scalable computation of aggregate statistics. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17), pp. 259-282,
Impact Statement
Diffie, W. and Hellman, M. E. New directions in cryptog- raphy. IEEE Transactions on Information Theory, 22(6), 1976.
This paper presents work whose goal is to advance the field Federated Learning. There are many potential societal consequences of our work, none of which we feel must be specifically highlighted here.
of
Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Möllering. H., Nguyen, T. D., Rieger, P., Sadeghi, A.- R., Schneider, T., Yalame, H. et al. Safelcarn: Secure aggregation for private federated learning. In 2021 IEEE Security and Privacy Workshops (SPW), pp. 56-62. IEEE, 2021.
References
Addanki, S., Garbe, K., Jaffe, E., Ostrovsky, R., and Poly- chroniadou, A. Priot: Privacy preserving aggregate statis- ties via boolean shares. In International Conference Security and Cryptogruphy for Networks, pp. 516-539. Springer, 2022.
Fernández, J. D., Menci, S. P., Lec, C., and Fridgen, G. Secure federated learning for residential short term load forecasting. CoRR, abs/2111.0924s 2021.
Bell, J. H., Bonawitz, K. A., Gascón, A., Lepoint, T., and Raykova, M. Secure single-server aggregation with (poly) logarithmic overhead. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 1253-1269, 2020.
Gao, J., Hou, B., Guo, X., Liu, Z., Zhang, Y., Chen, K., and Li, Secure aggregation is insecure: Category in- ference attack federated learning. IEEE Transactions Dependable and Secure Computing, 20(1):147-160, 2021.
Ben-Itzhak, Y., Möllering. H., Pinkas, B., Schneider, T., Suresh, A., Tkachenko, O., Vargaftik, S., Weinert, C., Yalame, H., and Yanai, A. Scionfl: Efficient and robust secure quantized aggregation. In 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 490-511, IEFE, 2024.
Garov, K., Dimitrov, D. I., Jovanović, N., and Vechev, M. Hiding in plain sight: Disguising data stealing attacks in federated learning. In The Twelfth International Confer- ence on Learning Representations, 2024.
Gehlhar, T. Marx, F., Schneider, T., Suresh, A., Wehrle, T., and Yalame, H. Safefl: Mpe-friendly framework for private and robust federated learning. In 2023 JEEE Security and Privacy Workshops (SPW), pp. 69-76. IEEE, 2023.
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., and Seth, K. Practical secure aggregation for privacy-

---

Janus: Dual-Server Multi-Rount Secure Aggregation with Verifiability for Federated Learning
Guo, X., Liu, Z., Li, J., Gao, J., Hou, B., Dong, C., and Baker, T. Verift: Communication-effici
buffered asynchronous aggregation. In International Con- ference Artificial Intelligence and Statistics, pp. 3581- 3607. PMLR, 2022.
and fast ver- ifiable aggregation for federated learning, IEEE Trans- actions on Information Forensics and Security, 16:1736- 1751, 2020.
Pasquini, D., Francati, D., and Ateniese, G. Eluding secure aggregation in federated learning via model inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 2429-222222 2443, 2022.
Guo, Y., Polychroniadou, A., Shi, E.,, Byrd, D., and Balch, T. Microfedml: Privacy preserving federated learning for small weights. IACR Cryptol. ePrint Arch., 2022:714, 2022.
Pedersen, T. P. Non-interactive and inforeation-theoreticc secure verifiable secret sharing. In Annual International Aryptology Conference, pp. 129-140. Springer, 1991.
Hahn, C., Kim, H., Kim, M., and Hur, J. Versa: Verifiable secure aggregation for cross-device federated learning. IEEE' Transactions on Dependable and Secure Comput- ing, 20(1):36-5,, 2021.
Rathee, M., Shen, C., Wagh, S., and Popa, R. A. Elsa:
Secure aggregation for federated learning with malicious actors. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 1961-1979, IEEE, 2023.
Hitaj. B., Ateniese, G., and Perez-Cruz, F. Deep models under the gan: information leakage from collaborative deep learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 603-618, 2017.
Salem, A., Zhang. Y., Humbert, M., Berrang, P., Fritz, M., and Backes, M. MI-leaks: Model and data inde- pendent membership inference attacks and defenses on machine learning models. In Proceedings of the 26th Annual Network and Distributed System Security Sympo- sium (NDSS), 2019.
Huang, Y., Gupta, S., Song, Z., Li, K., and Arora, S. Evalu- ating gradient inversion attacks and defenses in federated learning. In Advances in Neural Information Processing Systems, volume 34, pp. 7232-7241, 2021.
Sandholm, T., Mukherjee, S., and Huberman, B. Safe: secure aggregation with failover and encryption. ACM Transuctions on Modeling and Performance Evaluation of Computing Systems, 10(1):1-28, 2025.
Katz, J. and Lindell, Y. Introduction to Modern Cryptogra- phy, Second Edition. CRC Press, 2014.
Lu, L., Shin, Y., Su, Y., and Karniadakis, G. E. Dying relu and initialization: Theory and numerical examples, arXiv preprint ar 1rXiv:1903.061 1903.06333 2019.
Shamir, A. How share a secret. Communications of the ACM, 22(11):612-613 1979.
Ma, Y., Woods, J., Angel, S., Polychroniadou, A., and Rabin, T. Flamingo: Multi-round single-server secure aggrega- tion with applications to private federated learning. In 2023 IEFE Symposium Security and Privacy (SP), pp- 477-496. IEEE, 2023.
Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Mem- bership inference attacks against machine learning mod- els. In 2017 IEEE Symposiun on Security and Privacy (SP), pp. 3-18. IEEE, 2017.
So, J., Güler, B., and Avestimehr, A. S. Turbo-aggregate: Breaking the quadratic aggregation barrier in secure fed- erated learning. JEEE Journal on Selected Areas in Infor- mation Theory. 2(1):479 489, 2021.
McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A. Communication-effciie learning of deep networks from decentralized data, In Artificial Intelli- gence and Statistics, pp. 1273-1282. PMLR, 2017.
So, J., He, C., Yang. C.-S., Li, S., Yu, Q. Elii, R., Guler, B., and Avestimehr, S. Lightsecagg: a lightweight and versatile design for secure aggregation in federated learn- ing. In Proceedings of Machine Learning and Systems, volume 4, pp. 694-720, 2022.
Mohassel, P. and Zhang. Y. Secureml: A system for scalable machine learning. In 2017 IEEE Sym- posium on Security and Privacy (SP), pp. 19-38. IEEE, 2017.
Nasr, M., Shokri, R., and Houmansadr, A. Comprehen- sive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and feder- ated learning. In 2019 IEEE symposium on security and privacy (SP), pp. 739-753. IEEE, 2019.
So, J., Ali, R. E.,, Güler, B., Jiao, J., and Avestimehr, A. S. Securing secure aggregation: Mitigating multi-round pri- vacy leakage in federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 9864-9873, 2023.
Nguyen, J., Malik, K., Zhan, H., Yousefpour, A., Rabbat, M., Malek, M., and Huba, D. Federated learning with
Stevens, T., Skalka, C., Vincent, C., Ring, J., Clark, S., and Near, Efficient differentially private secure aggregation
10

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
for federated learning via hardness of learning with emors. In 31st USENIX Security Symposium (USENIX Security 22), pp. 1379-1395, 2022.
Tsaloli, G., Liang. B., Brunetta, C., Banegas, G., and Mitrokotsa, A. Deva: Decentralized, verifiable secure aggregation for privacy-preserving learning. In Interna- tional Conference on Information Security, pp. 296-319. Springer, 2021.
Wang, H., Xu, H., Y., Xu, Y., Li, R., and Zhang, T. Fed- cda: Federated learning with cross-rounds divergence- aware aggregation. In The Twelfth International Confer- ence on Learning Representations, 2023.
Y.
Wu, D., Bai, J., Song, Y., Chen, J., Zhou, W., Xiang, Y., and Sajjanhar, A. Fedinverse: Evaluating privacy leak- age in federated learning. In The twelfth International Conference on Learning Representations, 2024.
Xu. G., Li, H., Liu, S., Yang, K., and Lin, X. Verifynet: Secure and verifiable federated learning. IEEE Transac- tions Information Forensics and Security, 15:911-926, 2019.
Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE st Computer Security Foun- dations Symposium (CSF), pp. 268-282. IEEE, 2018.
Yueqi, X., Fang, M., and Gong, N. Z. Fedredefense: Defend- ing against model poisoning attacks for federated learning using model update reconstruction error. In Forty-first International Conference Machine Learning, 2024.
Zhang, C., Li, S., Xia, J., Wang, W., Yan, F., and Liu, Y. Batcherypt: Efficient homomorphic encryption for cross-silo federated learning. In 2020 USENIX Annual Technical Conference (USENIX ATC 20), pp. 493-506, 2020a.
Zhang, Fu, A., Wang, H., Zhou, C., and Chen, Z. A privacy-preserving and verifiable federated learning scheme. In ICC 2020-2020 IEEE International Confer- ence on Communications (ICC), pp. 1-6. IEEE, 2020b.
Zhu, L., Liu, Z., and Han, Deep leakage from gradi- ents. In Proceedings of the 33rd International Conference Neural Information Processing Systems, pp. 14774- 14784, 2019.
Zhuang. H.. Yu. M., Wang, H., Hua, Y., Li. J., and Yuan, X. Backdoor federated learning by poisoning backdoor- critical layers. In The Twelfth International Conference on Learning Representations, 2024.

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
A. Related Works
The primary objective of federated learning is to preserve the privacy of local data while enabling its effective use in training the global model. This section reviews the works related to Janus.
Masking-based SA. Masking is classic eneryption based on OTP (Katz & Lindell, 2014). (Bonawitz et al., 2017) designed the first SA scheme (SecAgg) which using pairwise masks to hide individual inputs for FL. However, SecAgg involves a complete communication graph, which incurs heavy computation and communication overhead for each user linear in the number of participants. Subsequently, (Bell et al., 2020) replaced that with a k-regular graph of logarithmic degree, which greatly improved the efficiency while maintaining the security. (Stevens et al., 2022) replaced the standard mask with learning with errors mask and used verifiable secret sharing to prevent malicious users from distributing incorrect shares, (Sandholm et al., 2025) arranged the users in the system the form of a ring chain, and the efficiency has been significantly improved. Additionally, the user dropout problem can be effectively solved. Most masking-based schemes require double masking in order to solve the problem of dropout. (Bonawitz et al., 2019) combined the random rotation technique to actively adjust the quantisation range of the model in order to reduce the model volume. To reduce the communication overhead, TurboAgg (So et al., 2021) divided n users into n/ log n groups and then used a multi-group loop structure for subsequent aggregation.
MPC-base SA. Multi-Party Computation (MPC) enables distrustful parties to jointly compute a target function while preserving privacy, which perfectly aligns with the SA. (Mohassel & Zhang, 2017) designed a scheme using secure two- party computation and proposed MPC-friendly alternatives non-linear functions. Prio (Corrigan-Gibbs, & Boneh, 2017) employed novel technique known as SNIPs (Secret-shared Noninteractive Proofs),, enabling servers to collaboratively verify a shared proof of correctness with minimal communication overhead. Prio+ (Addanki et al., 2022) replaced zero- knowledg proofs with Boolean secret sharing and share conversion protocols, boosting user-side performance. SAFELeam (Fereidooni et al., 2021) employed MPC to enable SA, resisting inference attacks with just two communication rounds while eliminating trusted third parties. (Gehlhar et al., 2023) proposed an MPC-based FL framework that combines SA with poisoning-resistane techniques, achieving privacy and robustness. (Ben-Itzhak et al.. 2024) introduced the ScionFL, which efficiently handles quantized inputs while providing robustness against malicious clients and supporting various 1-bit quantization schemes.
Attacks that Bypass SA. Most existing schemes expose the aggregation results to both users and the server. However, this design introduces a potential vulnerability: a malicious server may exploit this visibility to circumvent the secure aggregation. (Pasquini et al., 2022) proposed model inconsistency attacks, where a malicious server can distribute different parameters to targeted and non- targetd users. This can trigger dying-ReL.u and make the input of non-target users be zero. (So et al., 2023) noticed that when the trained model begins to converge, the user model changes little between one training step and the next. A malicious server can infer the updates of a user who participated in the previous round but did not participate in the subsequent round from the aggregation results. (Gao al., 2021) proposed scheme that can launch category inference attack even in the presence of SA. To avoid this type of attack, when the users receive the model parameters, they need to verify whether the received parameters are consistent or not, and terminate the training if they are not. But this will increase the system overhead. (Fernández et al., 2021) applied differential privacy on the aggregated model to hide the aggregation results.
Server-side Attacks and Defenses. Membership inference attacks pose a potential threat from the server side in FL.. Specifically, an adversary can determine whether some specific data records are part of the local training dataset of a target user only by accessing the model updates, either through a black-box or white-box approach. (Yeom et al., 2018) proposed the first label-basee based attack, which aims at predicting whether an instance is in the local data of the target user. The attacker leverages the target model's inferior performance on the test dataset to carry out the attack. (Chen & Vikalo, 2024) proposed general method that allows the server to recover user training labels, applicable to various FL algorithms without assumptions on activation functions or batch label composition. (Shokri et al., 2017) designed an attack with partial output knowledge in a black-box scenario. Furthermore, (Salem et al., 2019) improved a new attack by using the maximum value of the model output confidence. (Zhuang et al., 2024) introduced layer substitution analysis, a novel technique for identifying layers that are critical for backdoor injection, making it well-suited for FL attacks. This technique enabled the development of two layer-wise backdoor attack strategies that implant backdoors into key layers and bypass advanced defenses without degrading main task accuracy.
Meanwhile, (Bonawitz et al., 2017) proposed the first SA scheme to compute the sum of model updates hiding personal infor- mation. Subsequently, a great deal of research has centred around SA. Techniques such as homomorphic encryption (Zhang et al., 2020a), differential privacy (Stevens et al., 2022), and multi-party computation (Bell et al., 2020) are used to construct
12

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
SA schemes protect user privacy from attack by malicious servers. Cryptography-based SA aims to prevent attacks by hiding model updates from potential adversaries. Preserving the confidentiality of individual contributions, significantly reduces the risk of sensitive information leakage.
Recently, (Yueqi et al., 2024) identified a limitation in existing model poisoning attacks defenses: reliance on cross-client or global information, which leads to performance degradation or when there is a large number of malicious users. A crucial distinction between model poisoning attacks and benign model updates then established by determining whether the update can be approximately reconstructed using distilled local knowledge. (Wu et al., 2024) proposed FedInverse, a framework designed to evaluate whether FL models are susceptible to model inversion attacks and quantify the associated data-leakage risks. (Garov et al., 2024) showed that all existing malicious server attacks can be identified through systematic checks. Furthermore, essential requirements for practical malicious server attacks were systematically established.
Verifiability. In addition, a malicious server may return incorrect aggregation results to gain unfair advantages or undermine system integrity. Such behavior poses serious security risks, as it can mislead users who rely on the aggregated outputs. Therefore, verifiable SA is necessary to ensure correct aggregation. (Zhang et al., 2020b) verified the aggregation result via homomorphic eneryption and homomorphic hash function. Additionally, (Xu et al., 2019) verified masking-basee SA using the same technique. (Guo et al., 2020) proposed verification scheme that focuses on high-dimensional inputs. (Brunetta et al., 2021) proposed non-interactive verifiable SA protocol, which requires users to create tag for each input shares. In contrast, (Tsaloli et al., 2021) proposed scheme that requires only single tag for each user.
Multi-round Setting and Dynamic Joining, Model convergence in FL typically requires multiple rounds of training, with each round contributing incrementally to the overall performance of the global model. However, most existing state-of-the-ar SA schemes are designed to support only single round of aggregation. Beyond protecting user privacy in a single round of training, existing research has also explored privacy concerns that arise cumulatively over multiple rounds of training. (Nguyen al., 2022) and (So et al., 2022) proposed two new schemes support asynchronous aggregation. (Guo et al., 2022) designed multi-round SA protocol for reusable secrets, and it is mainly oriented towards scenarios with small inputs (the input vector with small values).
Recently, (Ma et al., 2023) proposed Flamingo, which has no restrictions on input value. (So et al., 2023) mitigated the privacy leakage involved in multi-round aggregation through client selection. Furthermore, the existing schemes do not support dynamic joining. Flamingo assumes that the set of all clients participating in the training is fixed before the training starts and some subset selected from n in each round t. Therefore, Flamingo does not support the user dynamically add in the training process. Most existing schemes require reconstructing the communication graph upon user join or departure, and performing key negotiation with all other users, leading to significant communication and computation overhead. In addition, (Wang et al., 2023) explored cross-round aggregation of local models and proposed FedCDA, a novel method that constructs the global model by aggregating local updates from multiple rounds based on minimum divergence. To improve efficiency, FedCDA incorporates an approximation strategy to reduce the overhead of model selection.
B. Detailed Janus and Its Instantiation
Figure 4 gives the full generic construction of Janus. Furthermore, efficient instantiation of Janus is provided, where the underlying SHC is instantiated by Pedersen commitment, the public key encryption is realized via ElGamal, and the OTP employs normal addition encryption. Specifically, Janus consists of the following four phases.
Setup. This phase determines the public parameters of the system. Firstly, all participants agree on the security parameter A. The public parameters of the cryptographic primitives are then generated based on X. Define a tuple (p, q, 9, h), where p is a randomly chosen prime of length lql À + 8, with 8 being a specified constant; q is a prime divisor of p - 1 such that q (p- - 1)/7, where 7 is specified small integer; and g, h are random generators of Z with order q. U generates its public/private keys (ph,, sk;) = ag (mod p), sk;,,, where the sk; E Zzz- S₁ generates its public/private keys (pk,, )k.) = (g (mod p), ska) where the sk. E Zy.- Then Si and U.. publish their public keys to all entities while keeping their private keys secretly.
Masking and Report. Each user U.S trains local data Di, to get the update Fstt for round t. U. masks the up- dated vector by t., = Masking sks,) = Ii,t + ske, (mod p). where ska E Z Then Us, encrypts the ski, via CT., Enc(pk,, skr,)) = ht (mod p). pkgt. (mod p)). Furthermore, Us, commits the Z2, via c,e = Commit(Er...ra.) gi (mod p). where the rie E 2z, and (cir mi (fe (mod p).g (mod p)).
13

---

Janus: Dual-Server Multi-Rouni Secure Aggregation with Verifiability for Federated Learning
1. Setup.
All parties get the security parameter X.
-This phase generates the public parameter pp the system, which contains the specifie commitment, one-time pad, and public key encryption.
The assitant server S generates its public/private keys (phis, skia and publishes public key to all users.
Each user generates its public/private keys (pks, sk;) and publish its public key to servers So and S1. Subsequent user-server interactions are via public key eneryption by default.
2. Masking and Report.
Each user computes ži, + Masking(ski,, xi,z), where the ski, is the private key generated by user U in round t.
Each user encrypts the private key in OTP CT,, <- Enc(ph,, shi,,), where the ph, is the public key of the assistant server St.
Each user generates the commitment Gs.e (carr, Cr,m) + Commit Ti.e), where the is the blinder and Cs,r, Ci,m is the commitment parts of blinder and message respectively.
Each user sends (is,s; Cirr) and (CTa,,, Ci,)) to So and S1, respectively.
3. Collection and Aggregation.
Su collects the messages (Li,e, Ci,r) from and parses 24, and Ci.--
Then Sn computes the O Fi, X, and O Ci, = Cr.
So sends the X, and C, all users.
S1 collects the messages (CTTi,e;,,,) from users and parses as CT,, t and CA
Si decrypts the ski,t + Dec(CTi,,, sk.) and computes O ski,t = SK,
- S computes the O am1 Ci,t C₁.
S sends the SK, and C, to all users.
4. UnMasking and Verification.
Each user receives the message from So and St, then it decrypts the ciphertext C, and X, using its private key ski,
Each user unmasks the aggregation via X, + UnMasking($SK, Xz).
Each user computes the commitment about the input updates via Cm <- Se(Ci,
- Each user generates the commitment via C < PCommit(XX, PP.), which is related to the updates. PP. is the public parameter of the commitment scheme. Then U., compares C _ C..- it is equal, then the aggregation result completed by So is correct, otherwise, it invalid. Once the aggregation results are found to be incorrect, users will terminate the subsequent training.
Figure Detailed Construction of Janus.
Finally, US, sends (ci.r 3,,1) and {cr,,, CTr,}} } to Sg and S,, respectively.
Collection and Aggregation. Subsequently, S, receives the message from Uz,.. Then it computes O,=1 Lt,t = $1, + 22, + .. fn, = X, and O Crr = h1 r...... (mod p) = C,. Then So sends C, and X, to all users. When the S receives the message from U,,-- first decrypts sk; = Dec(sk,, CT;,) = ski, - -pk ki.e (g 1t ) (mod p). Subsequently, computes O Ci = C1,,02,t...nx, (mod p) C. Then it computes O ski, = ski, t sk2, + ... skn = SK., Finally, sends the C, and SK, all users.
Unmasking and Verfication. When Us, receives the message from S, and St. Firstly, Ur computes the aggregation result via X, Unmasking( X, X, - SK,, To verify the validity the aggregation results, Us, separates the parts
14

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
of the commitments that only relevant the input updates by Se(Ci, C,) Cm- Then Us, makes a commitment the aggregation result from Sy via PCommit(Xx, PPc) = gx (mod p) = Cm where ppc is the public parameters of the underlying SHC. Eventually, U checks whether C. 1 Cm holds. If so, indicates that the aggregated result X, from So is correct; otherwise, the result deemed invalid. Us.t will refuse to accept the results of the aggregation and abort the subsequent training-
Correctness. The correctness of this instantiation is guaranteed long all entities follow the protocol honestly, ensuring that each user obtains both the correct aggregation result and valid verification. It is not hard to prove this due to the correctness of the underlying public key encryption, OTP, and SHC. Specifically, we assume that the aggregation server So receives all masked-input and performs Janus correctly, the following condition holds.
21,1 + -2,t
Zn,t
t=1
31it + ski, + x2,t sk:2, + ... Bnnt + ski,t
(8)
Ditt + skitt
i=1
X, SKr,
where the Oz ski,e is computed by Si. The final aggregation result is O Tips Oi Li. -O 0==1 ski,t = Xx, the validation passes, the following condition holds.
C. = m .... gf
- tor tra.t
G. prictractnttmn
(9)
Cm Ci/C, ttat
C = X:.
If the aggregation result X, from So is correct, then the C Cm always holds.
C. Security Analysis
In this section, we intend to demonstrate the security of our generic construction. We first give the threat model and prove that our Janus can protect the privacy of users' local updates and the aggregated updates. Finally, we give the security proof of single-round and multi-round respectively.
C.1. Threat Model
All users agree to publish the final results of model aggregation only each user, but not the servers, order resist MIA. These users share common interest in both coundness-ensurrie they receive the correct global model aggregation updates from untrusted servers and the confidentiality of local model updates from each other and the servers.
The specific assumptions in our paper are as follows: So and S will not collude but may perform incorrect aggregation. Janus also allows for up to n 2 clients to collude. Specifically, even if the servers aggregate incorrect results, Janus provides verifiability, which enables us to detect such behavior and mitigate the associated risks.
the server colludes with up to n 2 clients, can only obtain the additive result of the remaining two uncolluding clients. This result an aggregation of two enerypted or obfuscated values, making impossible to recover each uncolluding user's specific gradient information. This ensures that the colluding entities cannot initiate MIA access the private information of the remaining two non-colluding clients. When 2 clients collude, this assumption is even weaker, the absence of server involvement further limits the accessible information, making it even harder to extract useful data.
only a single server is corrupted, this does not compromise individual user privacy. For instance, with server Sg, as long as the underlying encryption algorithm is secure, the server cannot access the usbr-submitted private data without the user's private key. Similarly, for server S1. the security of the underlying SHC ensures that hiding properties prevent Si from
15

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
obtaining any private information. In conclusion, the assumptions of our scheme are reasonable and well-supported. In addition, assume the channel between each and the servers is secure, which allows each entity to authenticate the incoming messages and prevent outsiders from injecting their responses. Furthermore, we assume that there is collusion between all entities in the system. Our security proofs are based on this threat model.
C.2. Privacy from Users
In the "honest but curious" setting, each user will honestly adhere to the protocol but attempt to infer the local gradients of clients and the aggregated gradients. Therefore, we can use the standard simulation proof for multi-pan -arti computation protocols to demonstrate the privacy of our generic construction. We first consider privacy protection against honest-but- curious clients who hold their own local gradients and have access to the global gradients. Specifically, let II denote the proposed Janus involving n users C₁, C2,.., ..., Cn and two servers So and Si. Each user holds local update gradient 2; and Janus securely computes the aggregated global update X. All participants may attempt to infer additional information, the IT satisfies the following privacy guarantee:
For each honest-butccurious user C, the user learns nothing beyond its own local gradient x; and the final global aggregated gradient X. Formally, for each C₁ there exists a PPT simulator S; such that:
(Viewn(C.)) x (x),
(10)
where Viewn(C.) denotes the view of C2 during the real execution of II, 2; is the Ct's local updates and X the final global aggregated result.
For Sn and S1, they learn nothing beyond the masked aggregated results and the aggregated results of masks. This can ensure they will learn nothing about the final global aggregated gradient X, thus resisting the MIA. Formally, for So and 1 there exists PPT simulator S Seevver such that:
(Viewn(So- S1)} (Sserver (X, CT)),
(11)
where Viewn (So, S1) denotes the view of two servers during the real execution of II, X is the masked aggregation result, and CT is the ciphertext of masks.
Given any subset u S C of the users, where the is the set of all users in the system (C) = m). Let the REAL R.ALCA (E(E))((( (e(E (c1,r, o2,r...m.r)) be random variable representing the ioint view of the users in 2. This suggests that all these honest but curious clients learned the aggregation of the gradients of all clients and their own gradients.
Functionality F.
Parties: users I,...,N N from St and two servers So and St.
Parameters: corrupted rate 7j. number of participating training clients per-round
F, receives a set of corrupted parties C from the adversary A, where the [C]/|S:] S n7
For each round t:
1. .F, receives a set of clients S, and updates w1,t from clients i (S, (C..
2. FF sends S₁ to A and requests set M,. F, computes the X, O.E(MArc) Fi, if M, C S and continues; otherwise F. sends abort to all honest participants.
3. There are scenarios based whether the servers are corrupted A as follows.
Corrupted: F. outputs X, to all the participants corrupted by A.
Not corrupted: F. requests mask SK, from A and outputs X. ④ SK. to Sp.
Figure 5, Ideal functionality for Janus.
C.3. Single-Round Security
Theorem C.1. (Security of Janus) Let the security parameter be X and n be the number of users for aggregation in each round. Assuming the existence of secure OTP, SHC, and public key encryption. Our generic construction can securely
16

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
realize the ideal functionaliiyy Fg under the presence of a static adversary controlling 1i fraction of users (and the server S1) as shown in Figure 5.
(A,,, = IDEAL F F,S (A,n,TM.). REAL IIA
(12)
Proof. We first prove the security of single-round aggregation. Our generic scheme (denoted as IT) securely realizes the ideal functionality Ft (Figure 6) in the random oracle model. We can find from the ideal function F F that it is the M sent by the adversary A that determines the actual result. We assume the A controls set of clients and denote the set of corrupted clients as
Event 1. We start with the servers not being corrupted by the A. Now, we first build simulator in the ideal world. running A as a subroutine. Specifically, the simulation for round & follows.
1. S receives set Mj from the adversary A.
2. S acquires Z from the F sum
3. Masking and Report. S interacts with A as in the masking and report phase and acts as honest users in E {M; C} with the masked updates x such that the Ze- = OOEEM, (cy zh,,- Here the input update o',t and the mask ski, are generated by S.
4. Collection and Aggregation. In this phase, S interacts with A, where A performs honest participant in the collection and aggregation of II.
5. UnMasking and Verfication. S interacts with A as honest participants in the unmasking and verfication phase.
6. In the above steps, all honest participants would abort in the protocol in this round of aggregation, then S sends abort to Frum. Finally, A outputs the value at random and terminates this aggregation.
Functionality Ft sum
Parties: from St and two servers.
Parameters:
corrupted rate y).
Fr receives of corrupted participants C from the adversary and mye from clients E (S, C).
F, sends S; to A and requests a set Mr. F. computes the Zi = =OiE(Mercy Zt, if Mc C S; and continues; otherwise F, sends abort to the all honest participants.
For each round
1. .F receives of N clients S₁ and updates Fi,t from clients (Se 3,5%(.O. \.C..
2. FF. sends St to A and requests
Mr. F. computes the Z. -.EEMMicy Zi,1 if M. S, and continues; otherwise F. sends abort to the all honest participants.
3. There are two scenarios based on whether the servers are corrupted by AA as follows.
Corrupted: F, outputs X, to all the participants corrupted by A.
Not corrupted: F, requests mask SK, from A and outputs Z: O SK, S..
Figure 6. Ideal functionality for Report and Collection in round
We construct series of hybrid execution programs from the real world to the ideal world.
Hybrid 1. The view of A in the real-world execution is the same as the ideal world, when S has actual inputs from honest participants { i E St \ C including the individual masks sky and the SK;.
Hybrid does not use the actual masks OTP between honest participants. generates a random mask sk from the (0. 1)^, then it computes the corresponding OTP ciphertext as Jy,-- We argue the view of A in this hybrid is computationally indistinguishable from the previous hybrid 1 as follows.
Firstly, the mask sky, is computed from the space Ro of the ОТP, and the mask sk is randomly sampled in the ideal world. Let the Mj denote the set of users chosen by in the ideal world. A the ideal and real world can observes
17

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
( e; ske,) beteween user é M, and user i E M2- This indistinguishabiiity stems from the selection of random masks in the specific underlying OTP. Secondly, A can observe the ciphertexts generated from the skL The distribution of the ciphertexts is computationally indistinguishable from what A observes in the real world, assuming the security of the underlying OTP.
Hybrid 3. In this hybrid, instead of using OTP with actual personal mask ski, randomly selected from the space Rc, S uses masks randomly sampled from {0, 1jA. Before the proof, we model the generation of masks as a random oracle Or (see more details in the prior work (Bonawitz al., 2017)). For Vi E {M, C). the S samples skl, randomly and programs OR as 5 = i 2 Ti,t, where the &., is observed in the real world and the Z denotes the inverse operation of c. From the perspective of A, the distributions of L in this hybrid and the previous one are statistically indistinguishable.
Additionally, A learns the 5k4, in the clear for i E M2 in the real and ideal world. The distributions of ski, are identical. However, A learns nothing about shi, for i & M, in both worlds because of the semantic security of the underlying OTP. From the view of A, this hybrid is computationally indistinguishable from the previous hybrid.
Hybrid 4. In this hybrid, instead of controlling the random oracle as the previous hybrid, S will program the random oracle OR as sk., = â Ø x',,- Specifically, the d',55 are chosen such that (ie(M)r) Ti,t = De ( (MAcC) z4, From the view of A, this hybrid is the same as the previous one, which can be derived from Lemma 6.1 of the prior work (Bonawitz et al., 2017).
Hybrid 5. Similar to the previous operation, this hybrid replaces the mask of honest participants with the result from the random oracle. S will abort if the A would cheat by sending invalid masked updates to S. In the phase of unmasking and verification, the A would cheat by sending different M, to Fuum S will simulate the following protocol (see as Lemma C.2) and output whatever the protocol outputs. It identical to the previous hybrid by doing this.
The final hybrid precisely represents the execution of the ideal world. The aforementioned events indicate that our system is secure in the ideal world with single round process.
Event 2. In this event, the server is not corrupted by A, the whole simulation is the same as Event 1, except that the S will program the masks added by the A in each step.
We complete the proof that for any single round t, the protocol always securely realizes the ideal functionality F in the presence of static malicious adversary.
Lemma C.2. Assume there exists a PKI and a secure signature scheme, there are 3 participants with at most ( colluding malicious participants. Specifically, each party has an input bit of or 1 from a server. There exists a one-round protocol enabling each honest participant to determine whether the server sent the same value to all honest participants.
Proof. When an honest participant receives least 2 messages with the same value, it indicates that the server has sent the same value to all honest participants. In the given system, the threshold of 2Ç identical messages can only be met if large majority of honest participants have received the same value. Specifically, let the total number of participants in the system be n L, + mm. where l,, denotes the number of honest participants and Im denotes the number of malicious participants. For security and consistency in distributed protocols, the parameter Ç is set such that t, > 2ç. When an honest participant receives no fewer than 2 identical messages, it can confidently be concluded that at least Ç + of these messages were sent by distinct honest participants, ensuring consistency of the message content. Hence, it can be inferred that the server has broadcast the same value to all honest participants.
Conversely, if honest participant receives fewer than 2 messages with the same value, this suggests that the server may have sent different messages to different participants during the communication process. Since the number of identical messages received by honest participants falls short of forming consensus of 2Ç, it implies that the server may have engaged in malicious behavior by sending inconsistent messages to various honest participants. To ensure the security and consistency of the protocol, the honest participant will abort the protocol execution. This abort mechanism effectively prevents potential security threats and data integrity issues that could arise due to inconsistent messages from the server.
C.4. Multi-round Security
Our threat model assumes the corrupted rate is 17, which means that A controls 1) n clients throughout the total T rounds. In order to prove the security of the multi-round scheme on the basis of the above single-round security proof. The mask ski, computed from On of the underlying SHC TTc. Let A, denote the distribution of the adversary's 's view A in the single
18

---

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning
round i, and let T' be the total number of rounds required for model convergence. If there exists adversary B, and two rounds of aggregation 1 12 E [0, 7 where B can distinguish between At, and Atg- then
construct adversary A breaks the security of the underlying Ilc. Let the challenger in the security game of Ilç as S. Specifically, there exists two worlds (b = 0 or 1) for the OR game. S uses a random function when b = O. When b = 1, S executes the actual protocol c.. Then we build the A as follows. On input 41, le from B, the A asks for ski, for all honest participants in the round 4 and f2. can compute the masked updates from the prescribed. generates two views D,, Atz and sends them to the Finally, A outputs whatever outputs as the answer.
C.5. Resisting MIA
The MIA is effective primarily because the server is aware of the final aggregated result. the server can manipulate the parameters sent to different clients, it can introduce inconsistencies that influence the model training process, The key to resisting this attack is to ensure that all clients start with the same initial model parameters. This uniformity can be achieved through two main approaches: using a public bulletin board where the initial parameters are posted for everyone to see, through mutual agreement among clients to verify that the parameters they receive are indeed consistent across the network. The public bulletin board approach suffers from centralized dependency, information leakage, and scalability issues, while the mutual agreement method has high communication complexity, scalability limitations, and is vulnerable to Sybil attacks. Both methods face challenges in maintaining consistency and security as the number of clients increases.
significant advancement introduced by Janus is its novel design where the aggregation results are made visible only to the users. In Janus, each user computes the final result locally, rather than relying on the server. As a result, even if the server So distributes inconsistent model parameters to different users, it remains unaware of the actual aggregated model. This paradigm shift ensures that the servers cannot gain insight into the final result, thus preventing them from launching MIA.
Additionally, we assume that So and the users will not collude. In other words, the server cannot conspire with any users to manipulate the aggregation process. By decentralizing the aggregation computation and keeping the final result private among the users, Janus effectively mitigates the risk of successful MIA. This approach not only enhances the security of the federated learning framework but also reinforces the privacy and trustworthiness of the system by limiting the server's influence over the final model.
19


Reviews:
[{"review_id": "ssfYLUGBJn", "reviewer": "Reviewer_e8s4", "summary": "Janus proposes a 2-server aggregation protocol in which one of the servers provides the aggregated masked results and the other the aggregated masks and aggregated commitments so that clients can check that the results are consistent. The protocol also prevents the server from ever learning the output to improve the privacy guarantee. The paper goes on to explain the results of some experiments that check that ML still works if the gradient is aggregated using various different means of implementing discrete addition.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer e8s4,\n\nWe sincerely appreciate your time and effort spent on our work. We have noticed that most of your concerns stem from misunderstandings about our paper. Below, we will first clarify these misunderstandings point by point.\n\t\n**Misunderstanding 1. Security assumptions (W1&Q1):** \n\nWe clarify that we do not assume the server cannot corrupt a single client—rather, it ensures security even if the server corrupts up to n-2 clients. For large-scale FL (n ≫ 1), corrupting n-2 clients is impractical, making this a realistic assumption (lines 88-101 and Section C.1). Additionally, our assumption aligns with the prominent works like references [1] and [2]. Such an assumption represents a widely accepted and theoretically sound approach within this research domain.\n\n[1] Ma et al. Flamingo: Multi-round single-server secure aggregation with applications to private federated learning.\n\n[2] Rathee et al. Elsa: Secure aggregation for federated learning with malicious actors.\n\n**Misunderstanding 2. Unrelated Techniques and Secret Key Aggregation (W2,3&Q2):** \n\nOur work does not involve secret sharing and key expansion as you mentioned. Additionally, our work goes beyond merely implementing aggregation. We have also introduced multi-round, verifiable aggregation that is resistant to MIA, among other enhancements. Finally, secret key aggregation works as follows: clients first encrypt masks using S1's public key, then S1 aggregates, and finally users verify correctness by cross-checking with S0's aggregated values. This mutual verification between S0 and S1 provides the security guarantee without time-consuming RLWE, et al. The details are in Lines 264-317, with formal correctness analysis in Lines 715-740.\n\n**Misunderstanding 3. Security Proof (Q5):** \n\nOur security proof is correct: our scheme (lines 252-317) is consistent with the ideal function (lines 799-812, 846-862), where the server holds the masked aggregated gradients (Lines 288-317), and the client holds the gradient aggregation values. The security proof methodology follows the state-of-the-art scheme Flamingo (SP23). The only identified issue is a minor typo in the function definition (S1 should be S0), which does not introduce the inconsistency you raised. This typo will be corrected in the next version.\n\nNext, we will address your concerns point by point.\n\n**Concern 1. Malicious S_1 (W4):** \n\nOur scheme is already designed to resist the type of attack you mentioned. Specifically, S_0 and S_1 constrain each other, and users can validate the aggregated results of the two servers with the SHC. If either server attempts manipulation, clients detect inconsistencies during validation and abort participation. After theoretical analysis (Table 2), this does not increase our communication overhead.\n\n**Concern 2. New User Join (W5&Q3):** \n\nThe process for a new user to obtain the model is simple and straightforward. Specifically, the user only needs to retrieve the aggregation information from S0 and S1, and then, like any other user, they can locally obtain the model parameters. Moreover, the new user can not only acquire the model parameters but also verify whether the parameters provided by the two servers are correct. This is detailed in Lines 304 to 317 of the paper.\n\n**Concern 3. Experiment (Q4):** \n\nOur experiments aim to evaluate the trade-offs introduced by SA (increased training time, potential efficiency overhead) while demonstrating that these costs remain acceptable compared to the security and function benefits. Our experimental design follows the relevant literature such as [1,2] in the same field. Therefore, our experimental design is reasonable and well validates the theoretical analyses in Section 4.1.\n\n[1] Wang et al. VOSA: Verifiable and oblivious secure aggregation for privacy-preserving federated learning.\n\n[2] Ma et al. Flamingo: Multi-round single-server secure aggregation with applications to private federated learning.\n\nWe greatly appreciate your feedback and will incorporate these clarifications in the next version. Thank you again, and we look forward to your response.", "claims_and_evidence": "All the real justificaiton for the relevant claims is in the supplementary material so I haven't really read it closely. The protocol is fairly simple so it isn't too hard to understand what it does anyway.", "methods_and_evaluation_criteria": "I don't understand the point of the experiments section. Doesn't Janus just compute the exact (albeit discretized) aggregation of the contributions from clients, just like every other protocol for secure aggregation. If so how could the results of the ML experiments be any different and what is added by providing them.", "theoretical_claims": "I didn't check the proofs.", "experimental_designs_or_analyses": "The experiments seem pointless so I wouldn't know what to check.", "relation_to_broader_scientific_literature": "The key contributions seem pretty minimal, I don't think they contribute to the discussion usefully.", "essential_references_not_discussed": "There are no missing references that stand out.", "other_strengths_and_weaknesses": "There are a few problems with this paper.\n\nThe assumption that the server might be malicious to the point of running MIA attacks but not be capable of corrupting even a single client in a dynamic client system seems very unrealistic. Thus the value of the server \"not finding out the output\" seems pretty low.\n\nAggregation is easy in the two server model. That the inputs can be additively secret shared is decades old folklore and that one of them can be expanded from a key to reduce communication is also decades old folklore.\n\nThe secret key aggregation seems wrong, you seem to be assuming that the keys can be aggregated and expanded to give the same thing as if they have been expanded and then aggregated. Something like this is possible with RLWE c.f. ACORN or WILLOW, but you don't mention anything about that.\n\nIf you meant to aggregate the entire masks at S_1, this seems to give the server S_1 the opportunity to add any amount to the final aggregation completelynegating the point of the commitments (the only part of the protocol that isn't old folklore). Also this would substantially increase the communication overhead destroying probably all of your communicaiton advantage over other recent protocols.\n\nYou claim the protocol is multi-round and dynamic but say nothing about how a new joining client could get access to the up to date model. Obviously as the server isn't suposed to learn this it should be secret and you would need some plan to deal with it.", "other_comments_or_suggestions": "In your definition of SHC your c_m is never used as an input to any of the functions, so there is no implicit requirement on it at all. I think I know what you want because I assume you just want Pedersen commitments and to do the obvious thing at each point, but if you are going to specify SHC as a new primitive at least define it precisely. It isn't really a new primitive if the reader has to just guess what you mean from their knowledge of how (the rather old primitive of) Pedersen commitments work.", "questions_for_authors": "What situation is the no corrupt client assumption reasonable in?\n\nWhat do you mean by the secret key aggregation?\n\nHow do clients joining learn the model?\n\nWhat are the experiments intended to check, that isn't obvious from the fact you are replacing addition with something that is bit for bit the same under normal conditions?\n\nWhy does the functionality you define for your security proofs end with S_1 receiving the output when they are just a support server and hte output seems like it goes to the clients in the protocol? Is it because you don't know how to prove S_1 can't mess up the result that the clients receive? (this somewhat negates the point of the commitments and the reason you can't prove that is impossible is because there is an attack)", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aFqZCk2nS3", "reviewer": "Reviewer_uPUn", "summary": "This paper proposes Janus, a secure aggregation scheme based on dual servers for FL, whose core innovation lies in breaking through the communication constraints of the traditional single-server architecture: through the design of a bidirectional interaction protocol that supports multiple rounds of aggregation and verifiable results. Janus takes the lead in realizing the enhancement of users' offline freedom under the collaborative verification mechanism of the two servers. The dual servers each have their own role to constrain each other and securely solve the aggregation problem in FL. For dynamic user scenarios, Janus lifts the strong dependency of users online, so that new users can join or leave without reconfiguring the communication topology, which significantly improves system scalability. To support the architecture, the paper innovatively proposes SHC, which provides a cryptographic foundation for the dual-server paradigm. The experimental part verifies the theoretical analysis through side-by-side comparison of multiple datasets and similar advanced schemes, which improves the security while Jauns has good efficiency. Finally, the security analysis confirms the advantage of the scheme in balancing between efficiency and security.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer uPUn,\n\nThank you for your valuable comments. We address your concerns as follows.\n\n**1. Dynamic Engagement (W1):** \n\nOur scheme enables dynamic participation where clients can join or leave at any time without compromising security. The process is designed as follows: new clients simply (1) obtain system public parameters, (2) generate their key pairs, and (3) complete one training round with the initial model to receive the global update. Departing clients gracefully exit by ceasing submissions, while key updates follow the same streamlined joining procedure. Importantly, all participant changes occur without requiring reconstruction of the communication graph, maintaining both security and system efficiency.\n\n**2. Writing (W2):** \n\nThe current version outlines our security assumptions in the abstract and Lines 88-108, with complete formal specifications provided in Appendix C.1. We will incorporate a more detailed discussion of these assumptions in the next version.\n\n**3. Future Work (\tQ1):** \n\nBuilding on our current work, we will explore methods to resist client poisoning attacks, a common challenge faced by existing masking and encryption-based schemes. Additionally, we will focus on further enhancing both the efficiency and security of our approach.\n\n**4. Challenges of Multi-round (Q2):** \n\nThe challenges of multi-round aggregation are already discussed in Lines 42 to 98 of the paper. Specifically, the core challenges regarding this aspect are threefold: (1) most existing schemes require regenerating system parameters for multi-round aggregation, i.e., repeating a single round aggregation many times to realize multiple rounds; (2) practical training scenarios with dynamic participation (users joining/leaving) typically demand complex communication graph reconstruction; and (3) while existing approaches need dedicated, time-consuming operations to achieve both multi-round execution and MIA resistance, our scheme inherently resists MIA during SA without additional overhead.\n\nWe greatly appreciate your feedback and will ensure these clarifications will be included in the next version. If you have any further concerns, please let us know.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Yes, I checked the correctness and proof of security of the scheme in this article and both are correct.", "experimental_designs_or_analyses": "Yes, I checked these designs and found no issues.", "relation_to_broader_scientific_literature": "This paper realizes multi-round secure aggregation, which supports dynamic user updates while verifying the aggregation results, in addition to effectively resisting the model inconsistency attack, which are security issues that have not been simultaneously addressed in previous studies. This paper provides useful ideas for subsequent research.", "essential_references_not_discussed": "Essential related works for understanding the key contributions of the paper have been appropriately cited and discussed.", "other_strengths_and_weaknesses": "Strengths:\n\n1.\tInnovative architectural design. I like the overall solution idea of this paper, where the dual servers each have their own role to constrain each other and securely solve the aggregation problem in federated learning.\n\n2.\tEfficiency and scalability. Reducing client communication and computation overhead from logarithmic level to constant level significantly improves the efficiency.\n\n3.\tNew technologies and applications. The perfect fit of SHC and dual-server architecture can provide new ideas of privacy assurance for subsequent dual-server systems.\n\n4.\tEnhanced security. Protecting user gradient privacy while supporting verifiable aggregation results, effectively resisting model inconsistency attacks. The defense analysis of MIA could provide new ideas for such research.\n\nWeaknesses:\n\n1.\tInsufficient details of dynamic engagement. While dynamic user joining is supported, it is not clearly stated how to handle dynamic updates of user keys (e.g., key rotation mechanism), which may introduce the risk of long-term key compromise.\n\n2.\tNot reader friendly enough. Although the security assumptions in this paper are to some extent reasonable and feasible, the main paper is not friendly to read, and the paper only portrays the threat model in the appendices. However, I believe that highlighting these in the main paper can eliminate concerns about the security assumptions.", "other_comments_or_suggestions": "Suggestion: The potential of combining Janus with differential privacy or homomorphic encryption is not discussed, limiting its application to higher privacy demanding scenarios.", "questions_for_authors": "1.\tDespite the numerous capabilities and benefits of the proposed scheme, what limitations does it currently have?\n2.\tThis paper focuses on multi-round secure aggregation. What challenges does existing research face in achieving multi-round secure aggregation?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "Affirmed."}}, {"review_id": "1SNCvUSbQI", "reviewer": "Reviewer_LvMf", "summary": "This paper aims to address the challenges in existing secure aggregation (SA) schemes, including scalability with dynamic user participation, vulnerability to model inconsistency attacks (MIA), and the lack of verifiability in server-side aggregation results. The motivation is compelling and beneficial to the advancement of federated learning (FL). The proposed approach introduces a dual-server SA architecture and a new cryptographic primitive, namely Separable Homomorphic Commitment (SHC), which together enable key properties such as scalability, verifiability, and MIA security.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer LvMf,\n\nWe sincerely appreciate your valuable feedback. Below we provide a point-by-point response.\n\n**1. Dropout rate (W1&Q1):** \n\nTo ensure a fair comparison, it is crucial to recognize that mask-based approaches (including BBSA, VeriFL, and Flamingo in Section 4.2) fundamentally require solving the client dropout to achieve correct aggregation. While secret sharing can address dropouts, its reconstruction overhead grows substantially with higher dropout rates (as it must recover masks for all dropped clients). In contrast, our Janus framework maintains normal aggregation regardless of dropout events, giving it inherent scalability advantages. Existing evaluations of BBSA/Flamingo already consider dropout rates up to 30%, whereas our experiments focus on demonstrating Janus’s superiority under dropout conditions. Even at the modest 10% dropout rate we tested, Janus shows significant performance gains—advantages that would only amplify with increasing dropout rates. Thus, selecting a 10% dropout rate is both methodologically sound (aligning with prior work’s evaluation scope) and sufficient to highlight our core contribution: dropout-robust aggregation. We will explicitly discuss this rationale in our revision.\n\n**2. More Applications (Q2):** \n\nWe appreciate this insightful question regarding SHC's broader applicability. It is crucial to note that SHC is fundamentally a general-purpose cryptographic primitive, not limited to the specific applications we discussed. While our paper focuses on its application to SA in federated learning, SHC's architectural flexibility makes it adaptable to any scenario requiring both confidentiality and verifiability, particularly in distributed systems with accountability requirements. Specifically, SHC's cryptographic separation of concerns makes it uniquely suitable for: (1) medical data federation where SHC enables privacy-preserving auditing, (2) dual-server e-voting systems needing verifiable tallying, and (3) secure outsourced computation requiring input/output validation. We will add a discussion in the next version.\n\nThank you again for your insightful comments. We will integrate these clarifications in the next version. Please don't hesitate to share any further concerns.", "claims_and_evidence": "The detailed design sufficiently supports the authors’ claims. First, the dual-server architecture eliminates the need for heavy communication graphs, thereby efficiently addressing the challenge of dynamic user participation. Moreover, the integration of Separable Homomorphic Commitment further mitigates potential attacks from malicious servers, including privacy leakage via MIA and incorrect aggregation behavior.", "methods_and_evaluation_criteria": "The authors provide both theoretical and experimental evaluations. The theoretical analysis demonstrates the advantages of their proposal over existing SOTA schemes in terms of computation and communication costs. The experimental analysis further validates the feasibility of their approach in the FL setting. Specifically, the authors employ two datasets, MNIST and CIFAR, to assess the impact of their proposal. They evaluate training effectiveness and communication time, comparing their method with both the original FL framework and SOTA SA schemes. The final results demonstrate that the proposed approach is practical and effective in preserving model accuracy while enhancing security.", "theoretical_claims": "The threat model and security proofs are reasonable and correct. Specifically, the newly defined threat model within the proposed dual-server architecture is sound. The proofs concerning privacy, single-round security, multi-round security, and resistance to MIA are correct  and provide solid support for the authors' claims. Additionally, the authors provide clear examples of collusion resistance.\n\nOne possible suggestion is that the authors could briefly include a proof sketch in the main body, even though the detailed proofs are provided in the appendix.", "experimental_designs_or_analyses": "The experimental designs are sound and valid. The authors consider both dataset selection and multi-party scenario simulation. The chosen datasets are appropriate for covering diverse scenarios and models, particularly since the proposed approach is a generic construction not limited to a specific dataset or model. \n\nThe only concern is that the authors could provide further discussion on the rationale behind setting the user dropout rate at 10%, even though the theoretical analysis has demonstrated that the scheme can tolerate up to n−2 colluding users.", "relation_to_broader_scientific_literature": "Like existing literature, this work focuses on achieving secure aggregation (SA) in the FL setting. In addition to maintaining high accuracy and privacy protection, as ensured by existing SA methods, this work further achieves scalability, verifiability, and MIA security. Notably, its key components, including the previously mentioned dual-server architecture and SHC primitive, are lightweight yet capable of effectively guaranteeing the targeted properties.", "essential_references_not_discussed": "The current related works provide sufficient insight into the recent progress in SA research.", "other_strengths_and_weaknesses": "Strengths:\n- The design of dual-server-based SA protocol is concise yet effective, which successfully addresses the remaining challenges faced by existing SA protocols.\n- The proposed SHC is valuable for designing SA protocols in the FL setting and holds independent theoretical interest in commitment research.\n- The clearly defined threat model and solid security proofs not only substantiate their claims but also inspire further research on SA in the dual-server setting.\n\nWeakness:\n- The authors did not discuss the rationale behind setting the user dropout rate at 10% in Section 4.2.", "other_comments_or_suggestions": "1. A proof sketch could be included in the main body to provide a brief understanding of the security proofs, even for readers who do not consult the appendix.\n2. The potential applications of the SHC primitive could be further discussed to broaden its impact.", "questions_for_authors": "1. What is the rationale behind setting the user dropout rate at 10% in the experimental section?\n2. Are there other potential applications for the newly proposed SHC primitive?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LLoZgChZoh", "reviewer": "Reviewer_nXLy", "summary": "The paper proposes a new secure aggregation protocol for federated learning. This protocol relies on two non-colluding servers: one to aggregate masked gradients and the other aggregating one-time-pad masks. Compared to other similar schemes, the masks here are not secret-shared with a graph of neighbours, thereby enabling client dropouts etc. Also, due to the integration of a new cryptographic primitive (separable homomorphic commitments), the protocol provides security against model inconsistency attacks. The authors also implement and compare their protocol to prior works, confirming training accuracy and performance improvements.\n\n## update after rebuttal\nThanks for participating in the rebuttal process. After re-evaluating the paper while considering the rebuttal, there was unfortunately no increase in the score. While I'm confident that the paper will improve significantly by implementing some of the proposed changes, we can only evaluate what was submitted. In particular, the definition of the separation operation is not sufficiently clear, and the main body of the paper does not demonstrate that Pedersen commitments satisfy the required homomorphism property. Additionally, some arguments provided in the rebuttal are not sound; for example, a simple (hardware-accelerated) hash verification can also be performed in O(l) and should be less costly than using exponentiation-based commitment schemes.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer nXLy,\n\nThank you for your valuable feedback and suggestions. Below, we address each of your concerns.\n\n**1. Definition of SHC (W1&Q1):** \n\nThe output of the Commit algorithm is c, but c is not a simple tuple. In fact, we intend to convey that the complete commitment can be split into c_m and c_r via computation, rather than directly storing. We will revise the wording. The SHC is an abstract blueprint. In existing secure commitment schemes, any scheme that meets the properties we have outlined qualifies as a SHC. In fact, we instantiate SHC as the Pedersen commitment. Furthermore, when discussing the properties of SHC (lines 215-234), we have already discussed that the Pedersen commitment possesses the properties of SHC. Thus, its security is inherently guaranteed by the security of the underlying commitment, eliminating the need for a separate proof.\n\n**2. References:** \n\nMasking-based and MPC-based SA are orthogonal, with the former relying on mask generation and elimination, and the latter on distributed computations. To offer a more comprehensive view of SA, we will include the following excellent MPC-based works, including the references you recommended in the next version.\n\n**MPC-base SA.** Multi-Party Computation (MPC) enables distrustful parties to jointly compute a target function while preserving privacy, which perfectly aligns with the SA. (Mohassel & Zhang, 2017) designed a scheme using secure two-party computation (2PC) and proposed MPC-friendly alternatives to non-linear functions. Prio (Corrigan-Gibbs & Boneh, 2017) employs a novel technique known as SNIPs (Secret-shared Noninteractive Proofs), enabling servers to collaboratively verify a shared proof of correctness with minimal communication overhead. Prio+(Addanki et al., 2022) replaces zero-knowledge proofs with Boolean secret sharing and share conversion protocols, boosting client-side performance. SAFELearn (Fereidooni et al., 2021) employs MPC to enable SA, resisting inference attacks with just two communication rounds while eliminating trusted third parties and supporting client dropouts. (Gehlhar et al., 2023) proposed a MPC-based FL framework that combines SA with poisoning-resistant techniques, achieving privacy and robustness. (Ben-Itzhak et al., 2024) introduced a novel scheme (ScionFL) that efficiently handles quantized inputs while providing robustness against malicious clients and supporting various 1-bit quantization schemes.\n\n**3. Misunderstanding of Instantiation (W2):** \n\nWe have already provided a full instantiation in lines 640-714, not just the new primitive. The component primitives can be replaced with any instantiation that satisfies the conditions, enabling compatibility with different systems.\n\n**4. Security of Instantiation (W3):** \n\nWe have already proven the security of the generic construction in lines 742-957. The generic construction is an abstract structure, and there are multiple possible implementations. Proving the security of the generic construction ensures the security of all instantiated schemes. Meanwhile, some existing generic constructions [1-3], ensure security in the same way we do. In summary, the instantiation based on the generic construction provide equivalent security guarantees.\n\n[1] Nguyen et al. Multimodal private signatures, CRYPTO22.\n\n[2] Luo et al. Generic construction of trace-and-revoke inner product functional encryption, ESORICS22.\n\n[3] Yuen et al. DualRing: generic construction of ring signatures with efficient instantiations, CRYPTO21.\n\n**5. Other Defense of MIA (S1):** \n\nThe method you mentioned defends against MIA by adding an extra operation required in each round, while FL typically requires multiple rounds to converge. In contrast, our Janus naturally provides this defense upon completing aggregation, without any additional steps. Second, verifying the signed hash in every round could impose a significant operational burden on clients. We believe this effectively addresses your concerns.\n\n**6. Synonym and Typos (S2):** \n\nThe term 'semi-honest' is more suitable for our situation, and we will correct it.\n\n**7. Misunderstanding of Assumption (S3):** \n\nCompared to schemes that rely on the non-collusion assumption, our scheme enhances security by resisting MIA attacks and enabling verifiable results. Furthermore, it offers greater functionality by supporting dynamic participation and multi-round aggregation. Additionally, our assumption aligns with that of prominent works such as references [1, 2], both of which also rely on the non-collusion assumption, making it a common and reasonable choice in this field. \n\n[1] Ma et al. Flamingo: Multi-round single-server secure aggregation with applications to private federated learning.\n\n[2] Rathee et al. Elsa: Secure aggregation for federated learning with malicious actors.\n\nThank you for your time and effort. We will update the content in the next version. If you have any further concerns, please feel free to let us know.", "claims_and_evidence": "Claims regarding the efficiency and accuracy of the proposed secure aggregation scheme are substantiated with experiments.", "methods_and_evaluation_criteria": "The presentation of the new cryptographic primitive is not convincing. First of all, some parts of the definition are not clear, e.g., if Commit gives a tuple (c_m, c_r), then Se is a trivial tuple access rather than requiring any computation. Moreover, there is no proof demonstrating that the implemented instantiation (sketched in Appendix B) indeed fulfils the security properties (the security proof in Appendix C only covers the generic construction).", "theoretical_claims": "Claims on the security of the proposed instantiation of the SHC scheme are not substantiated with a proof.", "experimental_designs_or_analyses": "The experimental design for verifying performance overhead and accuracy seem appropriate, covering asymptotic and empirical results.", "relation_to_broader_scientific_literature": "The paper tries to enhance efficiency and accuracy of secure aggregation schemes for federated learning, while also providing robustness against model inconsistency attacks.", "essential_references_not_discussed": "In the introduction the authors claim that currently most secure aggregation schemes rely on a double masking approach. However, this ignores an entire class of secure aggregation schemes based on MPC / distributed aggregators. Likewise, such works are not discussed in Appendix A. Examples include:\n- Fereidooni et al.: \"SAFELearn: Secure Aggregation for private FEderated Learning\"\n- Gehlhar et al.: \"SafeFL: MPC-friendly framework for Private and Robust Federated Learning\"\n- Ben-Itzhak et al.: \"ScionFL: Efficient and Robust Secure Quantized Aggregation\"", "other_strengths_and_weaknesses": "Strengths\n\n+ New cryptographic primitive that might be of independent interest\n+ Reduced overhead compared to related works (both asymptotically and concretely)\n+ Support for client drop outs and security against MIA attacks\n\nWeaknesses\n\n- Definition of new cryptographic primitive not clear\n- Only sketch for possible instantiation of new primitive\n- No security proofs that the sketched instantiation fulfils all properties", "other_comments_or_suggestions": "The paper is fairly well written and mostly easy to follow. The proposed protocol has clear benefits over prior works, combining desirable features with reduced performance overhead. However, there are also several negative aspects as discussed in this review, preventing to recommend acceptance.\n\nWith respect to the potential vulnerabilities wrt MIA attacks, it is unclear why other simple solutions like publishing a signed hash of the aggregated model on a widely-visible medium or bullet-in board are not considered for users to verify that they have not been targeted.\n\nThe use of the notion \"semi-trusted\" is not clear. In §1, the authors state that semi-trusted servers could deliberately mishandle some gradients. It should be clarified if \"semi-trusted\" = \"semi-honest\" as typically semi-honest servers are assumed to not deviate from the protocol.\n\nSection 4.1 claims that Janus offers enhanced security over prior works. However, it should be noted that if the non-collusion assumption does not hold, there are significantly more severe consequences as the attacker then can single out individual gradients whereas this would still not be possible when relying on secret-shared masks.\n\nMinor/typos:\n- Line 221: Pdeersen", "questions_for_authors": "- Do you have a security proof for your instantiation of the separable homomorphic committment scheme?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper introduces Janus, a secure aggregation (SA) protocol for multi-round federated learning utilizing a dual-server architecture. Janus makes several valuable contributions by addressing key limitations in existing SA schemes. Notably, it provides an efficient mechanism for handling client dropouts across multiple rounds, a significant practical challenge. Furthermore, it incorporates client-side verifiability, allowing clients to confirm the correctness of the server's aggregation, enhancing trust and robustness. Supportive reviewers highlighted these features, along with the convincing security analysis against n-2 colluding clients and compelling experimental results demonstrating significant efficiency gains over the recent Flamingo protocol. While concerns were raised regarding the novelty and the practicality of the non-colluding dual-server assumption, these should be considered in context. The non-collusion assumption is standard for dual-server models and enables the enhanced security/verifiability features Janus offers. Regarding novelty, while individual components like secret sharing and commitments are known, their specific integration within Janus to achieve efficient multi-round SA with robust dropout handling and client-side verifiability appears to be a novel and worthwhile contribution, potentially offering advantages over prior work as argued by the authors. Criticisms regarding the MIA robustness mechanism and limited baselines, while technically valid points for discussion, do not negate the paper's core strengths. The client-side computation demonstrably mitigates certain MIA vectors compared to server-centric approaches, and the strong performance against the relevant Flamingo baseline supports the claims of efficiency. Overall, Janus presents a well-motivated and technically sound approach that advances the state-of-the-art in practical secure aggregation by effectively balancing efficiency, dropout tolerance, and verifiability, making it a valuable contribution to the field.
Decision: Accept (poster)