A Survey on Verifiable Cross-Silo Federated Learning
Authors: Aleksei Korneev
Jan Ramon
Venue: Accepted by TMLR ()

Abstract: Federated Learning (FL) is a widespread approach that allows training machine learning (ML) models with data distributed across multiple storage units. In cross-silo FL, which often appears in domains like healthcare or finance, the number of participants is moderate, and each party typically represents a well-known organization. For instance, in medicine data owners are often hospitals or data hubs which are well-established entities.  However, malicious parties may still attempt to disturb the training procedure in order to obtain certain benefits, for example, a biased result or a reduction in computational load. While one can easily detect a malicious agent when data used for training is public, the problem becomes much more acute when it is necessary to maintain the privacy of the training dataset. To address this issue, there is recently growing interest in developing verifiable protocols, where one can check that parties do not deviate from the training procedure and perform computations correctly. In this paper, we present a survey on verifiable cross-silo FL. We analyze various protocols, fit them in a taxonomy, and compare their efficiency and threat models. We also analyze Zero-Knowledge Proof (ZKP) schemes and discuss how their overall cost in a FL context can be minimized. Lastly, we identify research gaps and discuss potential directions for future scientific work.

Published in Transactions on Machine Learning Research (06/2025)
A Survey on Verifiable Cross-Silo Federated Learning
Aleksci Korncev
adckset.kornceeu@nnrii..j
University of Lille, Inria, CNRS, Centrale Lille, UMR 9189 CRISIAL
Jan Ramon
ron.ronnn@inria.ff
University of Lille, Inria, CNRS, Centrale Lille, UMR 9189 CRIStAL
Reviewed on OpenReview: https: // openreview. net/ net/forum? forum? id= BUGSUU
Abstract
Federated Learning (FL) is widespread approach that allows training machine learning (ML) models with data distributed across multiple storage units. In cross-silo FL, which often appears in domains like healthcare or finance, the number of participants is moderate, and each party typically represents a well-known organization. For instance, in medicine data owners are often hospitals or data hubs which are well-established entities. However, malicious parties may still attempt. to disturb the training procedure order to obtain certain benefits, for example, biasod result or a reduction computational load. While one can easily detect a malicious agent when data used for training public, the problem becomes much more acute when it is necessary to maintain the privacy of the training datasct. To address this issue, there is recently growing interest in developing verifiable protocols, where one can check that parties do not deviate from the training procedure and perform computations correctly. In this paper, we present a survey on verifiable cross-silo them a taxonomy, and compare their efficiency and
FL. We analyze various protocols, threat models. We also analyze Knowledooee Proof (ZKP) schemes and discuss how their overall cost. in FL context can be minimized. Lastly, we identify research gaps and discuss potential directions for future scientific work.
1 Introduction
Nowadays, the broad propagation of machine learning (ML) technologies is rapidly increasing. ML appli- cations affect varicty of fields such medicine, finance, marketing, education, and many others (Garg &
Mago 2021 Ozbayoglu al. 2020 Herhausen et al. 2024 Pinto et al. 2023). Many ML approaches rely process of training on historical data: a model learns statistical patterns that later allow new predictions to be inferred. However, in some cases, data may contain private or confidential information; therefore, access to such data is limited, and applying ML must be done with extreme cantion, either due to an interest in privacy of the data owners (DOs), e.g.; individual persons caring about their privacy or companies caring about intellectual property, or for regulatory compliance, c.g., with the General Data Protection Rogulations (GDPR).
In federated learning (FL), multiple DOs, who are also referred to clients, can train model together, possibly under the coordination of central server, by exchanging encrypted messages without revealing their private data. As a result, researchers can benefit. from a large amount of shared data and at the same time preserve privacy. However, while preserving privacy in FL allows protecting sensitive information, it also generates an additional challenge the verification of participants' behavior. Indcod, due to the possibility of malicious actions, is important to ensure that all calculations are performed correctly even if the used data is private.

---

Published in Transactions on Machine Learning Research (06/2025)
FL is often divided into two categories: cross-device and cross-silo. In the cross-device FL setting, data comes from large number of small and usually anonymous devices with low computational capacities. Anonymity complicates penalizing clients; a single client is free to abort or violate the procedure at any time. In contrast, in this paper we focus on cross-silo FL where the number of parties is moderate; cach party is usually a well-known and large entity that is expected to cooperate in the entire training process via devices with high computing power. Each party has an incentive to care about its reputation and can be held liable if it is found to be fraudulent. For instance, cross-silo FL appears in the healthcare domain, where DOs are medical centers or hospitals that collaborate to train ML models to improve patient care. Although the need for countermeasures against malicious attacks in such setting could be reduced due to the liability of participants, verification of the calculations is still required to establish confidence in FL's performance.
Recently, dozens of research works devoted verifiable FL have been published, proposing methods ensure the verifiability of the partics' computations, using different infrastructures and relying on various assumptions. Nonetheless, the best of our knowledge, verifiability in the context of eross-silo FL has not been thoroughly studied. Huang et al. (2022a) studied challenges of cross-silo FL setting in details, but the verifiability property was not taken into account. In (Zhang & Yu 2022 Tariq et al. 2023) authors were focused on verifiability in FL, however features of the cross-silo setting were not considered and pro- tocols' efficiency was not analyzed. In contrast to the taxonomy presented by (Zhang & Yu 2022 our
taxonomy is based on the verification techniques, which allows grouping similar approaches together and identify common design patterns that directly impact protocol properties (e.g., complexities, threat model assumptions). Unlike Tariq et. al. (2023), we formally describe the underlying verification techniques and analyze the complexities and threat models of the approaches, providing a deeper level analysis. [ohamad et al. (2023) presented a SoK paper devoled to secure aggregation protocols and included verification in the list of challenges, nevertheless, specific features of cross-silo FL were not in the scope of the paper and an efficiency analysis of verification techniques was not performed. Lastly, in (Labs) 2023 Xing et al., (023) authors studied applications of various Zero-Knowledge Proof (ZKP) schemes for ML, but these works do not address FT.
In this paper, we provide a survey verifiable cross-silo FL. Our contributions summarized as follows:
to the best our knowledge, we are the first to conduct a survey on verifiable FL while studying specific challenges of the cross-silo setting;
we propose a new taxonomy of cxisting verifiable cross-silo FL protocols while analyzing their cffi- ciency and threat models;
we perform comparison of ZKP schemes from the perspective of applying them in cross-silo FL and discuss the influence of parameters such as the ZKP scheme and circuit size on the cost;
we define future challenges and identify research gaps.
The rest of the paper is organized in the following way: Section introduces some background and notations of FL and crpylographie primitives; Section 3 presents analysis of existing verifiable cross-silo FL protocols; Section 4 is devoted to a comparison of ZKP schemes from the perspective of their applicability for cross-silo FL, then we describe a storage cost optimization for bas-d FL protocols; Section 6 describes challenges and research gaps; and Section 7 concludes the paper.
2
Background
2.1
FL process
The majority of FL approaches contain two main categories of operations: local operations (both on the side of the clients and the server) and aggregation of clients' values. Additionally, there are also other operations specific to certain FL protocols, for example, where participants should draw random numbers, exchange cryptographic keys select a subset of parties to communicate with.
2

---

Published in Transactions on Machine Learning Research (06/2025)
In this paper, we consider both settings where the aggregation is coordinated or performed by central server and settings where DOs perform the aggregation in decentralized way.
Some ML algorithms involve runming an optimization algorithm, egg,, stochastic gradient descent (SGD). We refer to each iteration such algorithm as an epoch.
2.2 Kios FL properties
While analyzing the suitability of various algorithms for the cross-silo FL. setting, assume that:
1. the number of participants is moderate (at most several thousands):
2. all participants have an incentive to care about their reputation, they may only cheat in way which can not be delected by others;
3. all participants agree on the model to be trained (type of calculations to be executed);
4. DOs possess computationally sufficiently powerful equipment.
In this survey, we do not focus on the cross-device setting due to its unique characteristics (e.g., a large number of parties, typically low computational resources) that would require a separate analysis to properly compare protocols with each other and determine the suitability of verification techniques.
2.3 Adversarial attacks FL
In survey (Borrrou et al. 2023 on FL threats two classes of adversarial attacks were distin- guished:
privacy attacks, whose purpose to infer sensitive information from the learning process;
attacks which aim at modifying the behavior or output of the FL process.
The development of a FL protocol that is resistant to adversarial attacks requires applying combination of various privacy enhancing technologies (PETs). For example, in order to prevent privacy attacks, authors of state-of-the-art solutions employ differential privacy (DP), multi-party computation (MPC), secure shuflligg and Trusted-Fxecution Environment (TEE) among others.
In this paper, we study verification techniques that allow mitigating the second class of attacks, attacks on the federated learning process, such as when an adversary intentionally uses incorrect data (data poisoning) performs computations incorrectly (model poisoning) to bias the resulting model. Authors of the considered papers applied commitment schemes, homomorphic hash functions, ZKP schemes and other methods to ensure that the federated model is computed correctly. A detailed analysis of these methods is presented in sections and
2.4 Verifiable FL
In the scope of this paper, we rely on definition of Verifiable FL inspired by Zhang & Yu 2022
Definition (Verifiable FL). FL is verifiable if selected parties able to verify that the tasks of all participants are correctly performed without deviation.
In practice, it is often assumed that a subset of participants follows the protocol honestly, while others are treated as potentially malicious. Depending on the specific use case, various actors within the FL, such as the server, aggregator, or DOs, could be considered untrusted, either individually or together. If only fraction of tasks is verified, others are either assumed be performed honestly or remain vulnerable attacks.
3

---

Published in Transactions on Machine Learning Research (06/2025)
We note that the definition does not specify the exact phase the FL process at which the verification process occurs, nor how the verifiers are selected. These details depend on the concrete design choices, assumptions, and other features of a particular verifiable protocol. In practice, it is common for FL participants to also act as verifiers. In such cases, the verification algorithm is executed after receiving potentially malformed data from interactions with untrusted parties. For example, clients may verify that the received updated global model has been correctly computed by the aggregator. However, there exists alternative scenarios: for instance, some approaches allow any external party act a verifier by inspecting all publicly available proofs. For such protocols, verification may occur at any moment, even when the FL training is finished.
Following this definition, in contrast to the survey by Tariq et al. (2023) we only include approaches that at least partly verify computations of the FL process. For example, we do not analyze protocols which are focused only on verification of identity, ownership, or data provenance. We also exclude protocols considered in (Mohamad al. 2023) that aim to prevent model poisoning attacks only by analyzing distribution of values submitted by parties. Such methods efficiently mitigate some attacks, but do not allow one to verify the correct of individual compulations
of the individual uses of the input data, e-g., an individual outlier input value is infrequent but possibly valid. Moreover, their efficiency depends the domain and the attacker strength. On the other hand, we do include in our analysis several protocols devoted to verifiable federated private averaging and verifiable cross-device FL since the same verification techniques could be used in the cross-silo FL. setting.
2.5 Threat models
In the scope of the considered works, authors usually rely two widely-spread types of threat models: honest-but-curious (a.k.a. semi-honest) and malicious. According to the standard cryptography definitions, an honest-but-
coness--uu-ccrroous curious agent does not deviate from the protocol, but keeps record of the protocol transcript and analyzes to gain information about other users, while a malicious adversary can deviate from the prescribed protocol instructions and follow an arbitrary strategy to obtain greater benefits. However, in the context of FT., authors often adapt these definitions with additional properties. In order to thoroughly analyze miscellaneous flavors of the applied threat models we distinguish the following four categories:
honest (or trusted): always follows the protocol correctly and is trusted with sensitive information;
honest-but-curious. always follows the protocol correctly, but is not trusted with sensitive infor- mation;
may try to forge different data, but otherwise follows the protocol, not trusted with sensitive information;
forger:
malicious: can arbitrary deviate from the protocol and is not trusted with sensitive information.
In the scope of this paper, in order to describe different approaches in rigorous manner, specify the robustness of protocols to participant drop-outs (marked with A), i.e. agents who register to participate but subsequently abandon the protocol, separately from the aforementioned categories of threat models. For example, to report that a protocol is robust both against forging and drop-outs, we denote its threat model as 'forger + A.
2.6 Blockchain technology
A blockchain is sequence of blocks, which holds a complete list of transaction records like conventional public ledger (Wang et al., 2018). A transaction could be any action taking place on a blockchain network, for example, a transfer of digital currency from one parly to another. In order to achieve the agreement about the ledger's state, blockchains rely on consensus mechanisms. For instance, one of the most popular mochanisms is Proof of work (PoW), where partics, called miners, calculate a hash of the constantly changing block header. When one miner obtains a relevant value, all others must confirm its correctness and add a collection of transactions used for the calculations a new block.
4

---

Published in Transactions on Machine Learning Research (06/2025)
In certain blockchain settings, parties deploy the blockchain code scripts, called smart contracts, that run synchronously on multiple nodes of the blockchain. Smart contracts can be stored in the blockchain and can be automatically executed when certain pre-conditions are met (Zou et al. 2021
2.7 Commitment scheme
A commitment scheme (CS) is a cryptographic primitive that allows parties to commit to values while keeping them hidden from others (Bhm 1983). party cannot modify the value after committing to it, but can later reveal it. We define formally as follows (Bünz et al, 2020):
Definition (Commitment scheme). A commitment scheme is a triple of algorithms (Setup, Commit, Open) where:
Setup(1²) - pp generates public parameters pp;
Commit(pp. æ) + (C:r) takes a private value x and outputs a public commitment C and (option- ally) a secret opening hint r;
Open(pp, r, + b {0,1} verifies the opening of commitment C' to the message provided with the opening hint r.
CSs often have two properties: hiding, meaning that commitment reveals nothing about the original value, and binding, meaning that a party cannot find other data yielding the same commitment, typically due to a computationally hard underlying problem. Lastly, some CSs are also homomorphic, mcaning that there are two binary operations + and defined in the domain of the original values and the domain of their commitments respectively, such that the following condition holds: Commit(z + y) Commit(z)) Commit(y), where x, y values possessed by party (or parties).
2.8 Zero- kerolknoweedge proof
Informally, ZKPs are eryplographic methods that enable party, referred to the prover, to convince another party, the verifier, of the validity of given statement without revealing additional information. In FL, the statement is typically represented as the satisfiability of an arithmetic circuit, which encodes computations performed by an untrusted party. For instance, such a circuit can encode the execution of the forward pass of a neural network, which expected to be calculated by a client. Using a ZKP scheme, a proving party can try to convince a verifying party(ies) that knows a witness w such that the circuit is satisfied given public input output x.
In this work, we primarily discuss Non-Interactive Zero-Knowledge (NIZK) proofs (Morais al. 2019
Definition INte-Interactive Zero Knowledge proof scheme). A NIZK proof scheme is defined as triple of algorithms (Setup, Prove, Verify), where:
Setup(1>) + (pk, vk) generates parameters: the proving key pk and the verification key vk;
Prove(pk, x, w) + π takes input the instance x, the witness w, and outputs the zero-knowledge proof m;
Verify(uk, T) + b E {0,1} receives the proof as input and outputs b, which is equal to if the verifier accepts the proof.
Various proving schemes exhibit different properties, such as hhowledge-sounddeen succinetness, computa- tional/statistical zero-knowledge. In this survey, we use 'ZKP" to refer to a general family of proving schemes and "proof" to denote the outcome of the proving algorithm. We invite the reader to (Thller 2022) for more details.
5

---

Published in Transactions on Machine Learning Research (06/2025)
3 Verifiable cross-silo FL protocols analysis
In this section, we discuss the leasibility of verification in the FL conlext, present a laxonomy of existing verifiable cross-silo FL protocols, analyze the efficiency of verification techniques and threat models, and discuss the impact of the cross-silo setting on verification. In the scope of this section, we refer to the number of clients C' and to the mumber of the aggregated vector dimensions as D.
3.1 Feasibility of verification in
FL
Before presenting the taxonomy, we will consider some more general issues. One could wonder whether it is possible lo verify the whole FL process. To answer that question, it helpful to describe the process of FL in two separate steps:
First, DOs commit to their data. Approaches that do not consider the threat of forgers don't strictly need this step, as they trust the DOs use correct data. Several approaches use cryptographic commitment schemes (see Section 2.7 or techniques with similar properties.
Second, the computations are performed. In this phase, the commitments are used (a) to ensure that values used in the computation are the same values as those committed to, and (b) to ensure that the required relations hold between the (commitment to) inpuls and (the observed) output.
In principle, one can prevent poisoning by using verification show that the inputs the DOs committed to and the outputs satisfy the desired relations. However, it is important to note that except for trivial cases it is not possible to both guarantee privacy, e-g., in the form of differential privacy, and fully prevent data poisoning. Indeed, we can see this as follows. Recall that datasets are called adjacent if they differ in at most one instance. Let A be (c, dddffferrnnt private algorithm (Dwork & Roth 2014). i.e., for any pair of adjacent datasets D and D' and for every subset Y of possible outputs, there holds P(A(D) C Y) < e P(((DD)) S Y)) 5, ie., the distributions of outputs of A for the inputs D and D' are indistinguishable (with tolerance (e, 6)). Now suppose that the private data of DO has actually value I, and the DO commits to value f to be used in the computation. Deciding whether there is data poisoning is equivalent to deciding whether
&. However, differential privacy dictates that the distributions of the outputs of A are indistinguishable (up to the tolerance (c, if in the input (only) & is replaced by z, so if x # a one shouldn't it be able to infer this from the output. Hence, requiring differential privacy prevents one from detecting data poisoning (of a single instance in a data set) by (only) observing the output of the private algorithm and the private verification.
For other notions of privacy, similar argumentts can be made. In general, enforcing privacy will allow (possibly limited forms) of data poisoning to be undetectable by any verification strategy. For example, when a DO poisons the data. before committing to it. In such cases, committed value f is in the proper domain. Moreover, the commitments have the benefit that DO who uses incorrect inputs will need to stick to the same incorrect values in all other computations using the same commitments. Note that privacy doesn't t affect the ability of DOs to commit to incorrect data, a malicious DO has this option both when there is privacy, e.g., differential privacy, and when there is none. One can also resort to other sources of trust, e-g, the commitment to & may be the same as an already known commit to private output of a previous verified computation, one can let a trusted third party verify that x = & if the DO can show to this trusted party both x, & and proof that is the real data while trusting that the third party will not disclose the private value.
could still ask the DO to prove that the
For model poisoning the situation is different, as this concerns computations after the DOs committed to their data. For example, methods providing differential privacy can be made robust against model poisoning. Even though the output itself is more noisy and hence verification based on the output only is more difficult, approaches such as ZKPs allow one to verify the correctness of the output before adding noise without revealing that sensitive output, and to verify that the noise added afterwards is drawn from the correct distribution (see e.g., Sabater et. al. (2223
6

---

Published in Transactions on Machine Learning Research (06/2025)
To conclude, while by any verification strategy, ensuring privacy does not necessarily hinder verifiability. As discussed above, in many cases verification and privacy can be to large extent combined.
FL may allow certain forms of data poisoning to remain undetectable
Lastly, we note that in the literature there exist alternative strategies to cope with other robustness issues next to poisoning attacks, e-g., non necessarily malicious byzantine failures that may cause among others outliers in the input distribution. Such Robust FL approaches often focus on eliminating outliers or mitigating the effects of outliers by using aggregation techniques less sensitive to outliers (Guerraoui et al. 2024). Such approaches are to some extent orthogonal to the verification approaches discussed in the current paper they are concerned with statistical propertics of the data distribution while verifiable computation discussed here starts from data for which the data owner claims it was generated from the right distribution. It is possible to combine verifiable computation and outlier-robust techniques, e.g., one could use a median aggregation rather than an average aggregation to decrease the effect of outliers, and then verify that the median is computed correctly. As stated in Scction 2.4, in the current paper we don't consider distribution- level strategies.
3.2 Taxonomy description
In order to ensure that a FL protocol is exccuted correctly, one has to verify both the local computations and the aggregation. We distinguish four categories of different verification techniques and describe each of them in details below. The taxonomy is presented in Figure [ also present timeline of protocols with respect to the taxonomy categories in Figure 2 Although cach approach has specific characteristics, our categories allow observing general design patterns and infer conclusions about their efficiency. For this purpose, we assess computational and communication costs both per client and per server for each method. The comparison of asymptotic complexities of protocols and applied threat models is presented in Table [ for approaches focused on verifiable aggregation and in Table / for approaches focused on verification of local computations. We emphasize that complexity metries are calculated specifically for the verification overhcad and do not reflect computation and communication which is needed even if verification is performed. Lastly, we assume that public key infrastructure, ML model weights, and seeds of PRGs are initialized before the training procedure and do not require a presence of trusted party.
Verification of aggregation
RA-basee
HP-based
VerSA
ZKP-based
GOPA zkFL
SVeriFL
SVFL
BytoChain
DE-based
ZkDFL
Signature- based
CS-based Fang et al.
Zhang
VFL
Rlickel al.
PVD-FL
Heiss et
DEVA
Madi et al.
Federify
Tag-based
VeriFL Hash functions based
NIVA
VerifyNet
FedTrust
Verification of local computations
Figure 1: A taxonomy of verifiable eross-silo FL protocols. The red color corresponds to approaches focused on the verification of clients' computations, the yellow color is used for approaches focused on the aggregation verification.

---

Published in Transactions on Machine Learning Research (06/2025)
VeriFL
FedTrust
HP-based
BytoChain
Fang et al.
VerifyNet-
Madi et al.
SVFL
RA-based
Zhang et al.
DEVA
VerSA
NIVA
SVeriLL
zkDFL
al.
Federify
ZKP-based
GOPA
zkFL
Rückel
PVD-FL
DE- DE-based
VFL
2020
2021
2022
2023
2024
Figure 2: A timeline of verifiable cross-silo FL protocols with respect to the laxonomy categories. The colors are identical to the ones in Figure
In order to fairly compare threat models of different approaches, we mapped the threat models described in the considered papers to the definitions from Section 2.5 and assigned a suitable model ourselves in cases where the authors did not explicitly describe In such cases, tables [ and / we use square brackets denote assigned threat models and collusion markers. Additionally, some articles provided descriptions of multiple threat models, for example, separate models from privacy and verification perspectives; our table reflects only those related to verification. We also note that assigning threat model for approaches based on blockchain infrastructure poses additional challenges. While clients' computations in such scttings are performed by the clients therssllvs. aggregation typically occurs as a smart ront. As a result, all miners (or a set of miners, see Section 3.3 redundantly compute the aggregation result. In such cases, in Tables [ and 2 the server's threat model corresponds to the threat model of miners. However, it important to mention that the blockchain infrastructure itself is also vulnerable to specific threats, which are often not detailed in articles devoted to blockchain-based FL. As example, Fang et al. (2022) explicitly mention that the protocol is robust when 70% of the stake in the system is honest, but for others such assumptions are not always easily visible. In tables and - the symbol *** corresponds to threat model applied to a fraction of agents. To sum up, threat models described in our tables for blockchain based approaches are meaningful only when the assumptions of blockchain infrastructure itself are satisfied.
In tables 1 2 as mentioned 2.5 we mark with "A' methods which are robust against client drop-out and/or server drop-out. For non-interactive methods (marked with 'A'), clients only interact once to submit their contribution, which results in rather trivial robustness against client drop-out: cither a client submits the contribution and a later drop-out of the client is not relevant, the client does not submit the contribution and then doesn't 't participate at all. For such approaches, once a client participates, his contribution will be taken into account in the computed aggregate if the protocol finishes. For interactive protocols, in all cases clients need to contribute to some form of 'decryption' the aggregate. Some approaches (Sabater et al. 2022) try to remove the input of the (sient(s) who dropped out so the set of clients who decrypt is exactly the set of clients who contributed input. In other approaches (Xu et al., 2020 Hahn et al., 2023 Tsaloli et al. 2021), robustness against client drop-out is achieved by threshold secret sharing where only fraction of clients is needed for this decryption. This decreases security, but avoids the need for computations to be rolled back. When we mark the server threat model as robust against drop-out, in all cases there are multiple servers (in the case of blockchain based methods multiple miners) of which a certain fraction can drop out without preventing the computation of the final result, e.g., due to a threshold secret. sharing scheme among servers or due to the consensus properties of blockchains.
Redundant aggregation (RA) based verification. This category consists of approaches that require the server to aggregate some redundant. values in order to prove that the aggregation of clients' values is performed
8

---

Published in Transactions on Machine Learning Research (06/2025)
Table A comparison of asymptotic complexities the aggregation verification overhead per epoch and threat models of verifiable FL protocols. Sections correspond to taxonomy categories (Figure I Notations: E number of epochs, C number of clients, D number of vector dimensions, BC requires blockchain infrastructure (the (significant) cost of the blockchain is not included in the table), S-C col. Server-Client collusion to bypass the verification, [...] not explicitly described in the paper.
Computational cost
Communication cost
Threat model
S-C
Approach
TA
BC
client
server
client
server
client
server
col.
VerSA
O(D)
O(CD)
O(D)
O(CD)
h-b-c A
forger
X
SVeriFL
O(D)
O(CD)
O(D)
O(CD)
h-b-c
forger
X
/
X
Zhang et al.
O(D)
O(C)
O(1)
O(C)
[hou]
forger
[
X
DEVA
O(CD)
O(CD)
O(CD)
O(CD) h-b-c A
forger A
X
X
NIVA
O(CD)
O(CD)
O(CD)
O(CD)
[h-b-c + Atl
Torger +
X
X
SVFL
O(D)
O(C)
O(1)
O(C)
h-b-c
forger
Madi et al.
O(D)
O(C)
0(1)
O(D)
hon
[forger
X
X
X
VerifyNet
O(D)
O(CD)
O(D)
O(CD)
h-b-c + A
forger
BytoChain
D(C+D)
O(D)
0(1)
0(1) hh-b-c + At
forger A
Fang et al.
D(C+D)
O(1)
O(1)
0(1) [hon + Ai]
[[orger* A
X
VeriFL.
O
0(1)
O(C)
0(1) h-b-c A
forger
CRS
FedTTrus
O(CD)
O(1)
O(CD)
0(1)
hon
forger + A
X
X
zkDFL
O(D)
O(CD)
O(C)
O(C)
hon + Aj
forger A
CRS
GOPA
O(DlggC)
N/A
O(DlogC)
N/A forger* + A
N/A
N/A
X
zkFL
O(CD)
O(CD)
0(1)
O(Clog(CD)) hhon + Ai]
[Forger + A
X
X
X/V
VFL
O(D)
0(1)
0(1)
O(1)
h-b-c
[forgr N/A
PVD-FL
O(D)
N/A
O(D)
N/A [orger*)
N/A
X
X
Table 2: A comparison of asymptotic complexities of the local computations verification overhead per epoch and threat models of verifiable FL protocols. Sections correspond to taxonomy categories (Figure
The notations are identical to the ones in Table
Computational cost
Comminccation cost
Threat model
S-C
Approach
TA
client
client
client
server
col.
Rückel et al.
O(D)
O(1)
0(1)
0(1)
[orger + Ai]
[orger*
X
CRS
Heiss et
O(D)
0(1)
0(1)
O(1)
[orger + Ai]
[orger* A
CRS
Federify
O(D)
0(1)
0(1)
0(1)
forger + Atl
forger*
A
CRS
/
PVD-FL
O(D) N/A
O(D)
N/A
[orger*
N/A
N/A
X
Algorithm Generic R.A-based verification
For client C;:
Input: Private data d:
1.
Receive the global model 0 from the server
2. Compute the local model 0g using d, and 0
3. Compute the ciphertext/tan t; using d, and/or/ 0
4. Send 0g and f to the server
Receive the updated global model 0+ and the aggregated ciphertext/tag t from the server Verify the correctness of 6+ using
For server S
Input: Global model
Send the global model each client
2. Receive ciphertexts/tags {4:{- and local models [0:) from all clients
3. Compute the updated global model 0+ by aggregating [
4. Compute the aggregated ciphertext/tag I by aggregating (4)C
5. Send + and f to all clients

---

Published in Transactions on Machine Learning Research (06/2025)
correctly. This feature leads to a computational cost of the server to be at least O(C). Moreover, some protocols (Tsaloli et al. 2021: Brunetta et al. 2021 Hahn et al. 2023) are designed under the assumption that each party has one secret value, therefore naive scaling of the approach to a FL setting where parties share multi dimensional data would lead to an additional factor D in the complexity. We present a generic
protocol with a RA-based verification of aggregation in the Algorithm [
In Zhhang et al. 2020 Gao et al.) 2023) authors proposed to check that the result of aggregation is correct by means of cryptographic signature schemes based on bilinear pairings. In both works, the server has to compute redundant aggregation of signatures. Indeed, such schemes allow ensuring that the aggregation result is obtained from data signed by all other clients, however malicious server may aggregate arbitrary signed values (e.g,, clients' values from previous epochs) and successfully pass the verification with a fab- ricated aggregated value. As a result, by relaxing the threat model, (Zhang et al.) 2020) achieves better complexity than other protocols of the same category.
In DEVA (Talllli et al.) 2021) and NIVA (Brunetta et al. 2021 decentralized FL protocols are proposed, all clients compute tags corresponding to the secret clients' values which are later used to verify that the aggregation is correct. Both protocols have an additional D complexity factor due to the assumption that each client has only one secret value. In contrast to many others, DEVA and NIVA present solutions for a setting with multiple servers. Another R.A-based approach is VerSA (Hahn et al. 2023) ). In VerSA all clients use the same secret vectors to compute a new input from their secret values and later check the consistency of the aggregated result with the aggregation of new inputs. Interestingly, the authors provide a comparison with VerifyNet (Xu et al., 2020) approach (which lies at the intersection of RA- and HP-based categories) showing that despite the same verification asymptotic complexity, the VerSA's A's cost. is orders of magnitude smaller.
Finally, from the treat model perspective, all RA-based approaches cope with a forger server while considering clients to be honest or honest-but-curious. Additionally, in SVeriFL. (Gao et al.) 2023), the integrity of the data shared by clients is verified, this threat is processed by addition of a trusted authority (TA).
Homomorphic property (HP) based verification. This category covers verification techniques which rely on the HP of underlying primitives: hash functions (Guo et al.) 2021 Hsu et al., 2022) and commitment schemes [L al. 2021; Fang et al. 2022p. The general idea of such protocols is the following: clients compute from their data and share them with each other, then all clients may verify the result of aggregation by checking that this result corresponds to the aggregation of hashes/ bashes//ommmimentt commitments through homomorphism. As a consoquence, both computational and communication costs of the server are ((1) if the ciphertext length does not depend on or D. In order to verify the aggregation of clients' values, clients have to compute a hash fash/coon /commitment in O(D) from their data and to aggregate hashes/ ccommitments from other clients in OCC). In blockchain-based protocols, clients upload besiles/commimmntt with a constant communication cost (to be multiplied with costs related to the blockchain infrastructure, see Section 3.3 while in other protocols, where clients have to exchange messages with each other, the communication cost per client is at least O(C). Exceptionally, in FedTTrus (Hsu et al. 2022) client costs have an additional complexity factor D, as lar as the hash is calculated for each component separately. We present a generic protocol with a Hasba verification of aggregation in the Algorithm 2
In VeriFL (uo et al. 2021), apart from the main protocol, authors also demonstrated a way to optimize the verification. Leveraging the homomorphic property of the hash scheme and the repetitive nature of FL caleulations, authors proposed an amortized verification which allows decreasing the number of hash function calls. Instead of checking that the product of hashes obtained from all clients is equal to the hash of the aggregated value obtained from the server after each epoch, one can draw a set of random coefficients to compute a linear combination of hashes obtained from all clients across multiple epochs and compare it with a hash of a linear combination of aggregated values obtained from the server using the same coefficients. As a result, in Table D the client computational cost of VeriFL differs from competing protocols by additional 1/ factor. Notable, since the core idea of all approaches of HP-based category is very similar, we observe that this optimization could be also applied to any of them.
There are also few protocols that lie at the intersection of the RA- and HP-based categories: VerifyNet Xu et al. 2020), Madi et al.) [2021 and SVFL (Luo et al. 2024 In VerifyNett, clients share additional values
10

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm 2 Generic HP-based verification
For client C,:
Input: Private data d,
Receive the global model 0
Compute the local model 0, using d, and 0
Compute the hash h2 of 0,
4. Send 0g to the server
5. Publish h;
6. Receive the updated global model 0+
7. Collect hashes from other clients { [hy)5=1a {=
8.
Check whether the hash of 0+ equals to the aggregation of hashes {h1)g=1
For server S:
Input: Global model
1.
Send the global model to each client.
2. Receive { from all clients
3. Compute the updated global model 6+ by aggregating (0:)
4.
Send 0+ to all clients
along with their gradients, which are later aggregated by the server. Aggregated values are shared back with clients so that they can verify the correctness of the gradients aggregation relying on the propertics of the homomorphic hash function. As a result, although the computational complexity of the protocol follows the trend of the RA-based category, the underlying verification technique shares similarities with those employed in Ha--based protocols. Similarly, SVFL is based the training procodure, the server performs a redundant aggregation of signatures and each client runs the verification algorithm based on the HP. Note that Luo et al. (2024) considered a malicious threat model for the server, however one should be careful while using signature-based verification techniques due to the concerns described above for similar approaches of the RA-based verification category (Gao et al. 2023
homomorphic signature scheme. During
Zhang et al. 2020).
ZKP based verification. The third category contains approaches which are based ZKPs. The core principle could be described as follows: a party performs calculations and at the same time computes the proof, which is shared along with the result of calculations; other parties can later run the proof verification algorithm to ensure that the result was computed correctly. In contrast to previous categories, ZKPs allow proving arbitrary computations, therefore such methods are suitable for proving the correctness of both aggregation of clients' values (Wang el al., [2024] Ahmadi & Nourmohammadii 2023 Sabater et al. 2022) and local computations (Keshavarzkalhorii advanced ZKP schemes provide proof size that is sublinear in the number of computations to prove. We
al. 2024 Heiss et al.) [022] Rückel et al. 2022). Moreover,
present generic protocol with ZKP-based verification of local computations in Algorithm 3
In protocols focused on aggregation, authors build on different infrastructures and ZKP schemes. In GOPA (Sbatee et al. 2022), authors introduced a decentralized gossip approach where nodes publish proofs of their computations using E-protocols (Attemn & Cramer 2020h. In zkFL (Wang et al.) 2024] the authors apply more modern ZKP scheme, Halo2 (Bowe et al. 2019). and provide two versions of the protocol: with a centralized FL setting and blockchain based one. In zkDFL (Ahmadi & Nourmohammadi 2023) authors rely the blockchain infrastructure and the Groth16 scheme (Groth 2016). We also observed that the authors of zkDFL and zkFL use different techniques to prove that each client value was indeed sent by one of the clients. In zkFL, all clients sign commitments to their local models, and the server includes the signature verification in the proof of own computations. Interestingly, with this example one can nol that ZKPs help to eliminate the need for clients to communicate with each other to verify the integrity of aggregated data. In zkDFL, authors proposod to deploy smart contract which checks that the result of redundant aggregation of local weights hashes performed by server is equal to the sum of hashes uploaded by clients (notably, computational burden of the aggregation verification is also transferred to the smart
11

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm 3 Generic ZKP-based verification
For client C,:
Input: Private data d,
Receive the global model A
Compute the local model 0; using d, and 0
compute the proof गr using intermediate values of the step as a witness 4. Send the local model 0g to the server
Run Prok.
Receive the updated global model #+
For server S
Input: Global model
1.
Send the global model 0 to each client
2. Receive local models {0:),= and proofs { from all clients
3. Run NIZK. Verify for each T. to verify the correctness of local models
4.
Compute the updated global model 6+ by aggregating {0:)
Send 0+ to all clients
contract). Consequently, differences in the settings and chosen ZKP schemes result in different complexity metrics.
In contrast to protocols with a verifiable aggregation, approaches focused on local computations verification
[Rickel et al., 2022 Heiss et al.] 2022; Keshavarzkalhori al., 2024) have almost identical design: all protocols use the Groth16 scheme achieve verifiability of clients' local computations in a blockchain based setting. However, authors focus on verification of different ML. models: linear regression model in (Rückel et a.. 2022), naive Bayes classifier in (Keshavarzkkalorri et al. (024)) and a feedforward neural network in (Heiss et al. 2022). In all three approaches, aggregation is performed by smart contract, therefore the correctness of the aggregation relies on the blockchain security assumptions. One can notice that proving, verification, and proof size complexities would be the same for the same type of computations, since all three protocols use the same ZKP schemn. Similarly, public parameters (including a Common Reference String (CRS)) which would also require the same amount of memory for storage.
three protocols participants need to have an access to
Additionally, in [Rückel et al. 2022 clients commit to the Merkle root of their private dataset while regis- tering in the system which allows ensuring data integrity within the whole training procedure. To achieve this, clients extend each proof showing that computations are performed with committed data. In Federify [Ksshavazzkalhorii et al., 2024), ZKPs are also applicd to prove propertics of local models, i.c., distance metrics indicaling how close the submitted model to the global one. As a result, both approaches prevent the risk of data poisoning the extent possible according Section 3.1
Lastly, it is important to mention that there many rescarch works devoted to proving the correctness of
MT. calculations without FL setting (Huang et al. 2022b Zhao et al. 2021 Hu et al. 2023) Often, the same verification techniques and developed optimizations could be applied in the context of FL to prove local computations of participants. We believe that the vast majority of such techniques would fit the 2KP-based verification category of our taxonomy.
Data Embedding based verification. This category covers protocols, where participants embed addi- tional values into their data before sharing it with untrusted parties; later, the result of calculations performed by untrusted source is assumed to be correct if the corresponding additional values computed correctly. The embedding principle leads to an increase in the size of the transmitted data and the complexity of the outsourced caleulations, which depends on the size of embedded values, and requires more expensive data preprocessing. We present a generic protocol with DE-based verification of aggregation in the Algorithm 4
One of the best approaches focused on the verifiable aggregation from the complexity perspective VFL (uu et al. 2022). In VFL clients encode their secret values as a polynomial function and embed an additional point (a;, A) before interpolation, where a, is parameter of client and A is obtained from pseudo
12

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm 4 Generic DE-based verification
For client C;:
Input: Private data d;
Receive the global model A
Compute the local model 0; using d, and 0
Calculate the modified local model d by embedding additional values
4. Send the modified local model 6, to the server
5. Receive updated global model _+
6. Verily the correctness of Ö+ using values a
For server S
Input: Global model 0
1.
Send the global model 0 to each client
2. Receive { from all clients
3. Compute the updated global model 0+ by aggregating (0:1c-1
4.
Send Ø+ to all clients
random generator (PRG) using a, as input. In order to verify the result of aggregation performed by a malicious server, each client checks that the evaluation of the aggregated polynomial function the point a, corresponds to the output of PRG with Σ ag input. In this protocol, transmitted data overhead is negligible, but each client has to compute costly interpolation and stores large public parameters.
In PVD-FL ZZaoo et al. 2022,, authors proposed a decentralized verifiable protocol which is based on the verifiable matrix multiplication algorithm. Parties embed random vectors into their data and then check that these vectors were correctly multiplied, as a result, the developed algorithm allows to verify basic operations of ML. In contrast to other approaches surveyed in this paper, in PVD-FL authors aim to show correctness of both aggregation and local models calculation. However, they also mention that their protocol still vulnerable to poisoning attacks.
3.3 Discussion
In this subsection, discuss how various features of the cross-silo setting impact the development of verifiable FL protocol. We highlight elficient schemes which cope with cross-silo FL challenges, describe the influence of the threat model choice on the efficiency and security of the protocol, and discuss advantages and disadvantages of the blockchain-based approaches.
Firstly, we describe the link between cross-silo selting characteristios and the efficiency of protocols. One can notice that in tables [ and 2 there are mainly two parameters determining the communication cost: C' and D. However, there is a large difference in their impact on complexity. Since the number of participants in the cross-silo settings is moderate while ML models typically have large sizes, dependence on D is less desirable. Nevertheless, taking into account that clients anyway must send their local models to server with O(D) communication cost, the overall FL complexity would become asymptotically worse only in cases when the verification overhead is larger than D. For example, such as in (Tslllli et al. 2021 Brunetta et al. 2021 Hsu et al. 2022), where the communication cost. OCCD).
Secondly, we observe that several approaches rely on a blockchain infrastructure (Fang et al. 2022 Li al. 2021
Ahmadi & Nourmohamnadi 2023; Rückel et al., 2022 Heiss et al. 2022). This strategy offers several advantages. For instance, smart contracts enforce transparent and verifiable distribution of incentives RRückel ct al.) 2022). The use of smart contracts to perform aggregation also makes the presence of a distinct server unnecessary, thereby replacing a single party trust with blockchain Irust guaranlees. All blockchain- based approaches are also robust against limited drop-outs of aggregators, i.e. miners. Table [ demonstrates that the verification overhcad per client generally smaller for blockchain-based approaches compared to non-blockchain protocols with similar verification techniques; however, there significant infrastructure overhead, e.g., costs of the miners, which is critical limitation within the context of cross-silo
13

---

Published in Transactions on Machine Learning Research (06/2025)
FL. The miners have to execute identical calculations, resulting in tremendous total computational burden across all participants. We note that the miners' overhead can vary across different blockchains depending on the consensus mechanism: while in Proof-of-Work (PoW) systems like Bitcoin, all miners redundantly exccute all computations, in Proof-of-Stake (PoS) systems like Ethereum, transactions are verified by a set of parties called "validators'. Although the general idea remains the same, the set of validators is smaller, reducing the overall computational cost. Moreover, blockchain-based approaches suffer from latency issues: the time required to confirm each block can slow down the FL training, Since FL computations are typically non-para panpparallelizable, for example, due to the sequential nature of neural network training, and may contain thousands of iterations, latency poses significant barrier to real-world deployment. Another challenge is the intensive energy consumption associated with costly consensus mechanisms. We invite the reader to Wenhua et al. (2023) for more details on the challenges related to blockchains. Finally, in cross-silo FL there is typically at least one party interested in obtaining the results of training, thus there is no a strong need for decentralized infrastructure.
Thirdly, during our analysis of verifiable aggregation protocols, we observed that server has several ways to fabricate the aggregation result, and sometimes a proposed protocol only addresses portion of them. Specifically, there are three ways in which a forger can manipulate the aggregation of clients' values: omitting one of the values, replacing one update with arbitrary data or inserting an additional update. However, in RA-based approaches that rely on eryptographic signature schemes, a verifier is only capable of checking that server has not omitted values from other clients and has not inserted additional values in the sum. Nev- ertheless, malicious server still may aggregate arbitrary signed values and successfully pass the verification. Therefore, such verification techniques should be employed with cantion.
Lastly, our observations indicate that the majority of verifiable aggregation protocols rely on either redun- dant aggregation mechanisms or leverage the homomoprhic properties of cryptographic primitives. However, these techniques are not suitable for proving complex computations, such as those encountered in ML. To address this limitation, rescarchers employ ZKP schemes, known for the ability to prove arbitrary compu- tations. We examined several ZKP-based protocols developed both to verily aggregation and more complex computation of clients. Furthermore, ZKP schemes offer the flexibility to reinforce the primary proof with additional information, showing the correctness of computed noise, data provenance, distance metrics. The complexity metrics of rKseb FL protocols directly depend the chosen scheme, however ob- serve the lack of justifications behind the scheme selection process in the literature. Considering the benefits of ZKPss and their advantage in comparison with other techniques, in the next section we examine existing ZKP schemes with a focus on their applicability in the cross-silo setting.
4 ZKP for cross-silo FL
The development of new ZKP schemes has been an active area of research over the past decade. While the surge of new protocols has led to a broad variety of schemes to choose from, it also resulted in additional desirable characteristics, making it challenging to determine the most suitable choice for a specific application. In this context, we discuss the applicability of ZKPs cross-silo FL and study how to prove calculations this setting minimizing the cost.
4.1 Applicability
In this subsoction, we discuss diverse characteristies of ZKP schemes, examining their implications within the context of the cross-silo FL setting. Specifically, we consider the time complexities for proving, verifying and preprocessing, the proof size, the CRS and the commit-and-pret property which some ZKP schemes feature, and the partition into transparent schemes versus trusted sctup based schemes.
Computational complexity of proving and verifying. In cross-silo FL, the verification of proofs generated during the training procedure presents a significant challenge: each party who wants to ensure the correctness of the protocol needs to execute a verification algorithm in order to check proofs coming from many participants. If the verification algorithm has a linear cost with respect to the size of the computations, the cost for the verifier is proportional to the combined computations of all other parties in the system, which
14

---

Published in Transactions on Machine Learning Research (06/2025)
is often too expensive. Furthermore, in scenarios where the protocol is publicly verifiable, e.g. when all proofs are stored on bulletin board as demonstrated in (Sabater et al. 2022 Brunetta et. al. 2021), verification of all proofs performed by an external party after the training procedure would become excessively time- consuming. Henco, we consider it is desirable that the verification time complexity is at most logarithmic in the total amount of computation to ensure leasibility within the FL selting. In contrast to the verification complexity, the proving complexity is of slightly less priority since each party has to prove only its own computations once. Consequently, the overhead incurred by executing an algorithm construct a ZKP is often feasible even if this algorithm is somewhat more expensive.
Preprocessing computational complexity. Achieving fast verification and small proofs often comes with a costly preprocessing phase, when the CRS is generated. Since this phase is completed only once before the training process, while the preprocessing complexity is a factor to consider, its impact is generally less critical than for algorithms that are executed within the training loop.
size. In verifiable FL protocol, all parties compute proofs of their local caleulations. If the proof size scales linearly with the size of computations, parties need to share data proportional to that computation. Such proofs would require gigabytes to petabytes of storage. In the context of publicly verifiable protocols, this problem becomes even more acute. Therefore, similarly to the requirement for verification cost, it is essential for the proof size to be at most logarithmie.
Common Reference Strings (CRS). Numerous NIZK schemes rely on generating a CRS during the setup phase. There exist two types of CRS: universal, capable of supporting all circuits of bounded size, and custom, applicable only for specifie circuits. The key advantage of universal CRS is that it eliminates the need for per-computation preprocessing Kosba et al. (2020), allowing the same CRS to be reused multiple times for different ML models. However, given that in FL all parties agree on the model to train, i.e computations to prove, there is no strict need to use a scheme with a universal reference string.
In the context of FL, all participants have to access the CRS to compute and verify proofs. The cost of delivering the CRS is determined both by the size of this CRS, and the challenge to broadcast this CRS in a way such that all recipients can trust it. One should take into account that the complexity of the CRS's size differs depending the ZKP scheme. Therefore, if the CRS scales linearly to the size of computations to prove and some heavy computations have to be proven, the storage cost will likely become prohibitively large.
Transparent and trusted setup based setups. A huge fraction of ZKP schemes depend on trusted setups to generate public parameters. Modern protocols often require only one honest party for this procedure. Since many cross-silo FI. protocols are developed under the assumption that at least one honest party is present in the setting, applying such schemes would fit the threat model of these protocols. At the same time, there exist transparent ZKP schemes that eliminate the need for trusted setup. As result, integrating such schemes into FL protocol would allow reliance on more robust threat model.
Some ZKP schemes maintain the commit-and-provt property, meaning that the prover can commit to certain data and later prove computations involving this data. As a result, a verifier will be able to check that data has not changed across multiple proofs. In the context of FL, this property is useful to demonstrate that DOs have not changed data during the training. Such a procedure mitigates the risk of one-shot data poisoning allacks and narrows capabilities of potential attackers (see Section 3.1
Commit-and-prove
Following the discussion above, in Table 3 we present an asymptotic comparison of various ZKP schemes with at most logarithmic size proofs realtive to the size of computations. Our comparison shows that while numerous schemes offer small proof sizes and fast verification, only MARK-based approaches (e.g.. SuperSonic, Dew) maintain a constant size of public parameters at the same time.
In general, a verification technique for FL protocol can be selected as follows. First, the list of assumptions should be specified, c.g., the threat models of all FL participants, the presence of trusted parties, or the presence of blockchain infrastructure. Secondly, using Tables ! and 2 one can mark relevant approaches that have been developed under the assumptions listed at the first step. If no approaches fit, one can check whether a combination of several approaches could be suitable. Finally, one should evaluate whether the
15

---

Published in Transactions on Machine Learning Research (06/2025)
Table 3: Asymptotic comparison of ZKP schemes with logarithmic and constant proof size complexity, is the computation expressed as a circuit, |C] is the number of gates in the circuit, |N] is the length of inputs.
Scheme
Parameters size
Proving
Verification
Proof Size
Dory Lee
2021
O(C))
O(CC))
O(log CT)
(logg[C])
Gemini (space-efficiet))
Bootle et al.
2022
O((C))
O(IC log" (og)
O CT)
(loog[C])
Gemini (time-efficient)
Bootle al.
2022
O(C))
O(IC))
Oloo C1)
(log|C)
SuperSonic Bünz et al.
2020
0(1)
O(CCoog(C))
Olog CC)
(log][C)
DARK-fix
Arun et
2023
0(1)
O(IC]log C))
Olog CT)
(log[[C)
BCCGP (Bootle et al. 2016
O(CC)
O(ICI)
O(IC)
Ologg[
Bullet
Buuz et a..
2018
O(CC)
O(IC))
O(C))
(log]C1)
Compressed
O(C))
O(IC))
O(ND)
(log((CI)
E-protocol
Attema Cramer
2020
Groth16 [Groth] 2016)
O(CC))
O([C)log
O(NN))
o(1)
Sonic
Maller al.)
2019
O(CD)
O(CCo (
O(N)
0(1)
GGPR
Gennaro et
2013
O(C)))
O(CCllog(C)
O([N])
0(1)
Pinochio
Parno et al.
2013
O((C))
O((C)log(C))
O([NN)
0(1)
PLONK Gabizon
2019
O(C))
O(IC)log]( (C)
O((NN)
0(1)
vaTinyRAM
Ben-Sasson el al.
2014
O(C[log][C)
O(IC log [C])
O((N))
0(1)
Mirage Kosba al.
2020
O(C))
O([Cologg (C))
O([N))
0(1)
Behemoth
Seres & Buresi
2023
O((C))
O(IC Clg
O(())
0(1)
Dew
Arun al. 2023
0(1)
O(CP))
Ollog CI) 0(1)
marked approaches meet the complexity requirements of the particular application. In the case of based approaches, it is also important to decide the first priority: fast verification and compact proofs (which lypically come logether), compact storage for the prover/verifier, or fast proving. Then, one can choose a specific scheme using Table 3 There are also other works, e.g., see (Labs) 2023), that provide the results of an experimental analysis of various schemes, which can help to assess concrete performance costs on top of the asymptotic characteristics. In practice, one might also consider other criteria, such as the availability of an open-source implementation for specific scheme, the programming language of the code, interface options, or the presence of auditor's reports. For instance, one of the most popular ZKP schemes, Groth16 Groohh 2016); has many open-source inplemenlations, making it easier to find suitable one for protocols that prioritize fast verification and compact proofs. We invite the reader to (Liang et al. 2025 for more guidelines on selecting ZKPs in different real-world scenarios.
4.2 Storage cost optimization
In the previous subsection, highlighted that one of the more important criteria for designing verifiable FL protocol is the total communication cost of ZKP schemes and the associated cost to store the proofs. If parties perform more computations than they want to include in a single proof, they can distribute their computations over multiple proofs. In this subsection we first study what is the best granularity of the proofs under different ZKP schemes and then discuss an alternative idea to prove computations based on recursive proof composition.
As in ML algorithm the same operations often repeated many times, c.g., for different data for different epochs in iterative algorithins, assume that one can produce a ZKP for all computations by repeatedly proving correct evaluation of a single circuit. Then, we introduce parameter k representing how many ovaluations of this circuit are included per ZKP. In order to understand the effect of grouping less or more computations together in a single proof, we define a function to compute the storage cost as a function of and then find the optimal number of grouped circuits prove, i.e., we find the k with minimum function value.
To begin with, we introduce the following notations:
E N the size of the minimal circuit in bits, i.c., the size of the smallest circuit so that the complete algorithm be represented as repetition of that circuit;
16

---

Published in Transactions on Machine Learning Research (06/2025)
N the number of circuits to prove;
1 the number of eircuits grouped for one proof:
8 N N- the function that, for certain ZKP scheme, gives the total communication cost c(); in bits to prove FL algorithm consisting of evaluations of circuit of size c, where proofs are given for groups of & circuits;
A:N the function that returns the proof size X(c) required to prove circuit of size in bits for a certain ZKP scheme;
き : N + N the function that gives the size of the public parameters ve()) required to prove circuits of size c in bits for certain ZKP scheme.
We also note that the cost per bit for the distribution and storage of proofs may be different than the cost per bit for the generation and distribution of public parameters, hence we scale vó and À with constants a and b to reflect the appropriate weights of a certain ZKP scheme.
Then, for an arbitrary ZKP scheme we can define in the following way:
8(k = av(kc) + nbd(kc)
k
One can see that if & = 1, then the storage cost is as in a classic verifiable FL protocol without the storage optimization.
One can notice that in Table 3 there are ZKP schemee with the same asymptotic complexities of proof and parameters size. Since in the scope this optimization, such schemes have the same optimal value of k we group schemes with the same complexities together and describe each group below.
Group 1: Constant parameters size and constant proof size.
We define the function &1 by instantiating & and À with corresponding asymptotic complexities of the Group in the definition 6:
nb
8, (k = a
k
One can see that in the simple case when ZKP scheme (for example, the Dew scheme (Aru al. 2023 has constant parameters and proof size, the function tends to minimum with the increase of k, thus the optimal n.
Group 2: Constant parameters size and logarithmic proof size.
Several approaches of this group can be found in Table SuperSonic [Bin et al. 2020 and its improved version called DARK-fix (Arun el al. 2023). In order to find an optimal A for this group, we define 63 similarly to the 8, using the logarithmic proof size complexity:
(2 = a nbb log(ck)
k
Since for k, the function is decreasing, the minimum also reached at n.
17

---

Published in Transactions on Machine Learning Research (06/2025)
Group 3: Linear parameters size and constant proof size. In table
there many approaches
with characteristios of the Group 3: Groth16 (Groth) 2016], Sonic
(Maller al. 2019), Pinochio
PPanno
et al., 2013), GGPR (Gennaro et al. 2013), PLONK (aabizon et al. 2019) Mirage (Kosba et al. 2020
Behemoth (Seres & Burcsi )023). We define 63 as follows:
8a(k; e, n) = ake + nb
k
We can approximately find the minimum of this function on integers by taking the derivative of the corre- sponding function on the reals:
(k,(k; cn)
nbb k:2
dk
The minimum value of d3 is K. Note, that in practice one has to check which of the two values [ke] or [ke] would give a minimal value of 83.
nb
Since ke could be less than one, the optimal & is min(max(Ka, 1), n).
ac
Group Linear parameters size and logarithmic proof size. Schemes which correspond the Group
4 are: Dory (Lee] 2021), Gemini (Bootle et al. 2022), Bulletproofs [Bunz et al. 2018) and Compressed Sigma- Protocol (Attema & Cramer 2020). Taking into account their complexities, we define d4 in the following way:
(k ack nb log(ck)
Let r= a and K = le, then
bnc
log(K) K) K
c, = -nnnrr
One can notice that the optimal value of depends on the value of r: the smaller the value of r, the larger the value of the optimal K. We present plot demonstrating the dependence of the optimal K on r Figure (a). As result, using this plot, one can choose the ZKP scheme with linear parameters size and logarithmic proof size and infer the optimal value of & with respect to the parameters of the chosen scheme and parameters of the FL setting.
Group 5: |C| log C parameters size and constant proof size. Lastly, we describe ds which corresponds to the Group 5 which consist of only one approach: vnTinyRAM (Ben-Sasson et al. 2014).
65(k; c, n) = ack log(ck) + nb
k
Applying the same substitution for the dz:
18

---

Published in Transactions on Machine Learning Research (06/2025)
700
600
300
250
300
150
200
100
50
0
10
10
10-3
10-2
10-9
10
Figure 3: The dependence of the optimal K on r for 54 (a) and åg (b).
1 (k bmc(KK KK (og(K)= + K
Similarly, to the previous group, the plot demonstrating the dependence of the optimal K on is presented in Figure (b).
With the above generally applicable strategy, one can determine the optimal number of grouped circuits to prove for various ZKP schemes in order to minimize the storage cost or, other words, communication cost of verifiable ZKP-basod FL protocol.
Still, the number of circuits in group is fixed, the costs get linear in the number of groups. In practice, handle reasonably large lcarning tasks, there
while the simple strategy discussed above already allows is maximal size lo group, e.g., due to memory storage limits. Hence, the asymptotic cost given bound memory storage remains linear, and given the ever growing size of ML tasks one could wonder whether one can do even better.
One idea which may address this issue, but has not been tried practical FL settings, is to compose proofs recursively, in particular use ZKP scheme that allows for constructing proofs that attest to the correctness of both circuits and other proofs in the same ZKP scheme. Following this idca, at the beginning prover creates proof for the first part of computations and then iteratively generates proof for the correctness of both the next circuit and all preceding proofs. Tf successful, this idea then could keep the work of the prover about linear in the number of computations, the memory storage of the prover constant, the proof size and communication cost constant and the verifier cost logarithmic.
Several papers have studied the theory of this type of approach. For example, the context of incrementally verifiable computations (IVC) (Kothapalli et al., 2022 Kothapalli & Setty 2022
2023 Bünz & Chen 2023)
proof-carrying data (PCD) (Zhou al. 2023) and zk Virtual Machine (zkVM) Liu et al. 2024). State-of- the-art solutions mostly rely on folding scheme, primitive that reduces the task of checking two instances of some relation to the task of checking a single instance (Kothapalli et al.] 2022]. For instance, authors of Nova hapali et al.) (022) were the first. to apply the folding scheme to IVC, resulting in a scheme where the prover's work is linear to the size of the smallest circuit, and the verifier's time and the proof size are logarithmic. Later, other authors presented advanced versions of the protocol such as SuperNova [Kothapalli & Sctty (002),, HyperNova (Kothapalli & Sctty (023),, and ProtoStar (Binz & Chen 2023) extending the original approach to more general settings and efficient arithmetizations.
19

---

Published in Transactions on Machine Learning Research (06/2025)
However, to the best of our knowledge, there are neither works studying efficient recursive proof com- position to verify computations in FT., nor works exploring whether solutions developed for IVC, PCD and zk VM could be adapted to FL. Among all protocols analyzed in Section only in zkFL (Wang et al, 2024) authors apply a recursive ZKP scheme: Halo 2. Nevertheless, they do not discuss the construction of minimal circuit or recursion properties of the chosen ZKP. Moreover, Halo is an early recursive ZKP scheme with linear verifier cost which not practical for large ML tasks. Therefore, the impact of recursion possibilities of the scheme on the FL complexities remains unclear.
We believe that applying more efficient recursive proof composition to verify FL computation remains open rescarch question and can potentially reduce the gap that prevents the use of ZKPs in practical applications.
5 Challenges and future directions
While verifiable cross-silo FL protocols is well studied area with plenty of solutions, our analysis reveals several challenges which have not been yet addressed by the research community. Below we discuss potential research gaps and future directions. The overview of the key challenges associated with FL participants is illustrated Figure! 4
Prevent ng client-server collusion that would bypass verification
Verifylng both client- side and server-side computations
Global model
Client
Mitigating mal icious behavio" (e.g., traffi: anylysis, side- channel attacks)
Trains local model 0,
Local model 6,
Exploring recursive ZKP for more afffiiintterifiub protocols
Global mozel 0
Client 2
Local model 6g
Aggregater egates local models
Trains local model
Developing optimizatiors based repetitive nature
Giobal mode! e
Verifying corn plex aggregaticn algorithms
Local model Oc
Trains a local model 6g
Figure 4: An overview of key challenges and future directions.
Firstly, to the best of our knowledge, there are currently no verifiable FL protocols that fully support verification of both computations performed by clients and server the same time. Exceptionally. PVD-FI. (Zhao et al. 2022) aims achieve this, however the approach does not guarantce the correctness of all actions of participants and is still vulnerable poisoning attacks. While some papers, such (Li et all, 2021), consider threats from both the server and clients, authors do not verify the clients' behavior, but analyze the distribution of their values to address potential attacks. Instead, we believe it would be an interesting direction to design a protocol that would enable verification (following the definition in 2.4 of actions of all participants. It would be later intriguing to compare different approaches from the threat models and the efficiency perspectives.
Secondly, we observe that verifiable aggregation is primarily studied for the most popular type of aggregation averaging of vectors possessed by DOs. Nevertheless, in certain settings, other U-statistics with kernel
20

---

Published in Transactions on Machine Learning Research (06/2025)
of the degree two larger (e.g. Kendall rank correlation coefficient) could be applied (Bell et al. 2020 introducing new challenges in the verification process. Based on our analysis, we can see that ZKP- verification would potentially fit, however finding an efficient solution still remains an open problem.
Thirdly, we observe that the repetitive nature of FL training is usually overlooked while developing a verifiable protocol. Nevertheless, this property opens up an opportunity to design various optimizations. For instance, in (Guo al. 202I), the authors considered this property to combine verification of multiple epochs together, thereby reducing the computational cost of clients. Following similar ideas, in Subscction 4.2 proposed an optimization based on the observation that instead of repetitive proofs in FL, one can group circuits together before proving, thereby optimizing communication costs. However, we believe that other optimizations, for example, for approaches from other taxonomy groups, require further analysis.
Fourthly, among the papers considered in this survey, there are no protocols that are robust against a collusion between client and server to bypass the verification. However, in real world scenarios such collusion might occur. Interestingly, in VerSA (Hahn al.) 2023), the authors do not consider collusion atlacks, justifying this choice with the impossibility result shown in (Gordon et al.) 2015). The authors of the latter paper demonstrated that in specific settings multi-client verifiable computation cannot be achieved in the presence of users colluding with the server. Nonetheless, the specific setting considered does not necessarily apply to FL. For instance, in contrast to the setting from (Gordon et al., 2015), in a verifiable FL protocol clients may exchange messages with each other or prove computations interactively. As a result, this impossibility result does not necessarily show that a verifiable FL protocol cannot be developed to be robust against server-client collusion attacks. In theory, verification can offer robustness against client-server collusion using zero-knowledge proofs by (a) letting both the clients and the server prove their computations, (b) letting clients and servers show that the hidden intermediate results their proofs refer to (e.g., the messages sent) are consistent, e.g., by proving/publishing /publishing identical hash values of these secrets. We believe that the development of a practical protocol is an interesting direction for future research.
We also observe that all verification protocols from our analysis rely either on purely honest, honest-but- curious, or forger threat. models, or extend them with robustness against. drop-outs. There exist. other attacks, which defending is often harder, e.g., attacks based on side channels or traffic analysis. None of the reviewed approaches formally prove to be robust against any malicious party. Still, the attacks considered in our analysis are likely the most important ones that can afflict the most harm.
Another interesting direction for future research would be to explore existing open-source implementations, available frameworks or tools for verifiable FL. We believe it would be valuable for practitioners to have access to comprehensive analysis of world systems where verification has been successfully implemented.
Lastly, as described in Subsection 4.2 to the best of our knowledge, there are no works exploring the
applicability of recursive ZKP schemes in the context of FL. In recent years, there has been an active rescarch in the ZKP community to develop such schemes (Bowe et al. 2019 Kothapalli et al. 2022. Kothapalli & Sctty 2023)- We anticipate that they deserve a particular attention. Their characteristics may allow for new optimizations and significant reduction in complexities of verifiable protocols.
6 Conclusion
In this paper, presented survey on verifiable cross-silo FL. We proposed new taxonomy distinguishing four categories of verification techniques. We described general design patterns for each category and provided an analysis of threat models, computational and communication costs both per client and per server for cach protocol. We also discussed how various features of the cross-silo setting impact the verification process and highlighted advantages of ZKP-based protocols. As a continuation of our conclusions, we discussed the applicability of different ZKP schemes for cross-silo FL and optimization stratogics to minimize the communication cost. Finally, we described several rescarch challenges revealed in our analysis and indicated future scientific directions.
21

---

Published in Transactions on Machine Learning Research (06/2025)
Acknowledgment
We would like to thank Anca Nitulescu for fruitful discussions on ZKPs. We also thank the action editor and anonymous reviewers for their valuable comments.
This work was partially supported by the 'Chair TIP' project funded by ANR, I-SITE, INRIA and MEL, the Horizon Europe TRUMPET project grant no. 101070038 and has benefited from French State aid managed by ANR under France 2030 program with the reference ANR-23-PELA-001 (REDEEM project).
References
Mojtaba Ahmadi and Reza Nourmohammadi: zkdfl: An efficient and privacy-preserving de- centralized federated learning with zero-knowledge proof. https://syythicaa..cmm com.a/iiic....omm//iiil.......
11 2023.
Arasu Arun, Chaya Ganesh, Satya Lokam, Tushar Mopuri, and Sriram Sridhar. Dew: A transparent constant-sized polynomial commitment scheme. In Public-Key Cryplography - PKC 2023: 26th TACR International Conference on Practice and Theory of Public-Key Cryptography, Atlanta, GA, USA, May 7-10, 2023, Procoedings, Part II, pp. 542-571, Berlin, Heidelberg, 2023. Springor- ISBN 978-3-031- 31370-7. doi:
19. URL htttps://doi.org/100 1tt.:///.0..000077------3-333331
Thomas Attema and Ronald Cramer. Compressed o-protocol theory and practical application to plug & play secure algorithmics. Daniele Micciancio and Thomas Ristenpart (eds.), Advances in Cryptology CRYPTO 2020, pp. 513 543, Cham, 2020. Springer International Publishing. ISBN 978-3-030-56877-11
James Bell, Aurélien Bellet, Adria Gascon, and Tejas Kulkarni. Private protocols for u-statistics in the local model and beyond. In Silvia Chiappa and Roberto Calandra (ods.), Procoedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pp. 1573-1583, Online, 26-28 Aug 2020. PMLR. URI. https://proceeednngs mlr. press/v100//eel120abbbtll
Eli BassSn Alessandro Chiesa, Eran Tromer, and Madars Virza. Succinct Ion-nnteractive zero knowl- edge for a von neumann architecture. Tn 23rd USENIX Security Symposium (USENIX Security 14), pp. 781 796, San Diego, CA, August 2014. USENIX Association. ISBN 978-1-931971-15-7, URL https:// usenix....coom
Manuel Blum. Coin flipping by telephone a protocol for solving impossible problems. SIGACT News, (1):23-27, jan 1983. ISSN 0163-5700. doi: 10.145/1008908.0089911 URL 1008908. 1008911
Jonathan Bootle, Andrea Cerulli, Pyrros Chaidos, Jens Groth, and Christophe Petit, Efficient zero-knowledge arguments for arithmetic circuits in the discrete log setting. In Procoodings, Part II, of the 35th Annual International Conference Advances in Cryptology EUROCRYPT 2016 Volume 9666, pp. 327 357, Berlin, Heidelberg, 2016. Springer-Verle Verlag. ISBN 9783662498958..
Jonathan Bootle, Alessandro Chiesa, Yuncong Hu, and Michele Orrú. Gemini: Elastic snarks for diverse environments. In Orr Dunkelman and Stefan Dziembowski (eds.), Advances in Cryptology EUROCRYPT 2022, pp. 427-457, Cham, 2022. Springer International Publishing. ISBN 978-3-031-07088-3.
Scan Bowe, Jack Grigg, and Daira Hopwood. Halo: Recursive proof composition without trusted sctup. IACR Cryptol. ePrint Arch., 2019:1021, 2019. URL https://app: wwwanticscholar.r..mmmmomomo wtwp:echhhhaarrooooooooooeo Cotg/oorpusl:: 202670380
Carlo Brunetta, Georgia Tsaloli, Bei Liang, Gustavo Banegas, and Aikaterini Mitrokotsa. Non-interactive, secure verifiable aggregation for decentralized, privacy-presevvig learning. Cryptology ePrint Archive, Paper 2021/654, 2021. URL https::/eprrntt iacr org/20//////
22

---

Published in Transactions on Machine Learning Research (06/2025)
B. Bunz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell. Bulletproofs: Short proofs for confidential transactions and more. In 2018 IEFE Symposium on Security and Privacy (SP), pp. 315- 334, Los Alamitos, CA, USA, may 2018. IEEE Computer Society. doi: 10.1109/SP.2018.000 attps://doi... http://t....ccoouuuurrcccccee..a 10. 1109/SP. 2018. .000000000
URL
Benedikt Bünz, Ben Fisch, and Alan Szepieniec. Transparent smarks from dark compilers. In Anne Canteaut and Yuval Ishai (eds.), Advances in Cryptology EUROCRYPT 2020, pp. 677-706, Cham, 2020. Springer International Publishing. TSBN 978-3-030-45721-11
Benedikt Bünz and Binyi Chen. ProtoStar: Generic efficient accumulation/folding for special sound pro- tocols. Cryptology ePrint Archive, Paper 2023/620, 2023. URL htttps://eprintt iacr org/2023/620 https://eprintt.iant iacr ottp///3///2//000
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends@ in Theoretical Computer Science, 9(3 4):211 407, 2014. ISSN 1551-305X. doi: 10.1561/ 0400000042. URL http://dx doi wtt.d./or.....////./....././//// 151/00000061000000000002
Chen Fang, Yuanbo Guo, Jiali Ma, Haodong Xie, and Yifeng Wang. A privacy-preserving and verifiable feder- ated learning method based on blockchain. Computer Communications, 186:1-11, 2022. ISSN 0140-3664. doi: https://ddo..ogg///0000/////ooo
http://000000011ooooo0m0m00m00/0 atticleepp1//0044066220003
URL. httpss//wwwwsseeeeeerrrr..... http////eeee.rtt.ccooccccccccc/.
Anmin Fu, Xianglong Zhang, Naixue Xiong, Yansong Gao, Huaqun Wang, and Jing Zhang. Vfl: A verifiable federated learning with privacy-preeerving for big data in industrial iot. IEEE Transactions Industrial
Informatics, 18(5):3316-33) 3226,,3266222 2022. doi: 0110099/1122220033666
Ariel Gabizon, Zachary J. Williamson, and Oana-Madalina Ciobotaru. Plonk: Permutations over lagrange- bases for oecumenical noninteractive arguments of knowledge. LACR Cryptol. ePrint Arch., 2019:953, 2019. URL https:://// www.ssiiismoolllaatt.e.ee http:///..a.aaaa..oooooooooooppa
org/CorpusID: 201685538
Hang Gao, Ningxin He, and Tiegang Gao. Sverifl: Successive verifiable federated learning with privacy-
proserving. Information Sciences, 622:98-114, 2023. ISSN 0020-0255. doi:
2022.11.124. URL httpp::/www.ssiicceel//// httpe//iiiittttteeeeeeeeeeeeeeee httpa/dd......ooo.ccc...c...oonn
Arunim Garg and Vijay Mago. Role of machine learning in medical research: A survey. Computer Science Review, 40:100370, 2021. ISSN 1574-0137. doi: http:///0aaaoo///..o0oocceeeeee0
URL
Rosario Gemmaro, Craig Gentry, Bryan Parno, and Mariana Raykova. Quadratic span programs and succinct nizks without peps. In Thomas Johansson and Phong Q. Nguyen (eds.), Advances in Cryptology EUROCRYPT 2013, pp. 626-645, Berlin, Heidelberg, 2013. Springer Berlin Heidelberg. ISBN 978-3-642- 38348-9.
S. Dov Gordon, Jonathan Katz, Feng-Hao Liu, Elaine Shi, and Hong-Sheng Zhou Multi-client verifiable computation with stronger security guarantees. In Yevgeniy Dodis and Jesper Buus Nielsen (eds.), Theory of Cryptography, pp. 144-168, Berlin, Heidelberg, 2015. Springer Berlin Heidelberg. ISBN 978-3-662- 46497-7.
Jens Groth. On the size of pairing-based non-interactive arguments. In Proceedings, Part II, of the 35th Annual International Conference on Advances in Cryptology EUROCRYPT 2016 Volume 9666, pp. 305 366,26,,45 Berlin, Heidelberg, 2016. Springer- Verlag. ISBN 9783662498958.
Rachid Guerraoui, Nirupam Gupta, and Rafael Pinot. Byzantine machine learning: A primer. ACM Comput. Surv., 56(7), April 2024. ISSN 0360-0300. doi: 10.1145/3616337. 3616537
URL http::://doi.or/111// 1145/
Xiaojic Guo, Zheli Liu, Jin Li, Jiqiang Gao, Boyu Hou, Changyu Dong, and Thar Baker. Verifl: Communicttion-cffiicee and fast verifiable aggregation for federated learning. IEEE Transactions on Information Forensics and Security, 16:1736-1733 1751, 2021. doi: 10.100//TTTS.200033333333
23

---

Published in Transactions on Machine Learning Research (06/2025)
Changhee Hahn, Hodong Kim, Minjae Kim, and Junbeom Hur. Versa: Verifiable secure aggregation for cross-device federated learning. IEFE Transactions on Dependable and Secure Computing. 20(1 (0:36:6- ):36- 52, 2023. doi: 2T0.://TSS..221.1110000
J. Heiss, E. Grunewald, S. Tai, N. Haimerl, and S. Schulte. Advancing blockchain-based feder- ated learning through verifiable off-chain computations. In 2022 IEEE International Conference Blockchain (Blockchain), pp. 194-201, Los Alamitos, CA, USA, aug 2022. IEEE Computer Society, doi: 10.1109/ http/Blooccchii5522222 www.:m/555222222.0022222 2022.00034. Blockchain55522 2022.00033
URL https://doi www..aattttteetttttyee.oooooeeee
Dennis Herhausen, Stefan F. Bernritter, Eric W.T. Ngai, Ajay Kumar, and Dursun Delen. Machine learning in marketing: Recent progress and future research directions. Journal of Business Research, 170:114254, 2024. ISSN 0148-2963. doi: http:://oo..og///..0o/////irorr
www.:.02...111.11 2123..1444.. 114254.
URL https:
Chih-Fan Hsu, Jin Huang, Feng- Hao Liu, Ming-Ching Chang, and Wei-Chao Chen. Fedtrust: Towards building secure robust and trustworthy moderators for federated learning. In 2022 TEEE 5th International Conference on Multimodia Information Processing and Retrioval (MIPR), pp. 318 318-323, CA, USA, August 2022. IEEE. doi: 10.1109/mijj httm///ppp59000000 w0w. 000633. URL battp://dss doi org 1109/MIPR54900. .02290000.000...... 00063
Chenfei Hu, Chuan Zhang, Dian Lei, Tong Wu, Ximeng Liu, and Liehuang Zhu. Achieving privacy-preserving and verifiable support vector machine training in the cloud. IEEE Transactions on Information Forensics and Socurity, 18:3476-3491, 2023. doi: ATF.9//IFF2222.....
Chao Huang, Jianwei Huang, and Xin Liu. Cross-silo federated learning: Challenges and opportumities, 2022a.
Chenyu Huang, Jianzong Wang, Huangxun Chen, Shijing Si, Zhangeheng Huang, and Jing Xiao. zkm- laas: a verifiable scheme for machine learning as a service. In GLOBECOM 2022 2022 IEEE Global Communications Conference, pp. 5475 7780,, Rio de Janeiro, Brazil, 2022b. IEFE. doi: 10.1109/ TAA.://OOM45009202222000000
Chazaleh Keshavarzkalhort Cristina Pérez-Solà, Guillermo Navarro-Arribas, Jordi Herrera-oaanoomaru, and Habib Yajam. Federify: A verifiable federated learning scheme based on zksnarks and blockchain. IEEE Access, 12:3240-3225 -255, 2024. doi: 10.1109/ 1011099/ACESSS ACCESS. 2023.3347039.
Ahmed Kosba, Dimitrios Papadopoulos, Charalampos Papamanthou, and Dawn Song. Mirage: Succinct arguments for randomized algorithms with applications to universal zk-snarks. In 29th USENIX Security Symposium, pp. 2129-2146, Boston, MA, USA, 08 2020. USENIX Association.
Abhiram Kothapalli and Srinath Setty. SuperNova: Proving universal machine executions without universal circuits. Cryptology ePrint Archive, Paper 2022/1758, 2022. URL https:////ppr iacr. orgg/022/1722 https://eprint.iace aat.aarrorg//22//7555..
Abhiram Kothapalli and Srinath Setty. Hypernova: Recursive arguments for customizable constriint systems. 0rc.0///000///
Cryplology ePrint Archive, Paper 2023/573, 2023. URL
https:
//eprint.iact iacr ort.cr23///00//5333333
Abhiram Kothapalli, Srinath Setty, and Toanna Tzialla. Nova: Recursive zero-knowledge arguments from folding schemes. In Yevgeniy Dodis and Thomas Shrimpton (eds.), Advances in Cryptology CRYPTO 2022, pp. 359-388, Cham, 2022. Springer Nature Switzerland. ISBN 978-3-031--1987--
Modulus Labs. Zero-knowledge proof meets machine learning in verifiability: A survey. https://drive.
2023. 2023.
Jonathan Loc. Dory: Efficient, transparent arguments for generalised inner products and polynomial com- mitments. In Kobbi Nissim and Brent Waters (ods.), Theory of Cryptography, pp. 1-34, Cham, 2021. Springer International Publishing. ISBN 978-3-030-90453-1.
24

---

Published in Transactions on Machine Learning Research (06/2025)
Zonghang Li, Hongfang Yu, Tianyao Zhou, Long Luo, Mochan Fan, Zenglin Xu, and Gang Sun. Byzantine resistant secure blockchained federated learning at the edge. IEFE Network, 35(4):295-33 -015,-00---0000 2021. doi:
Junkai Liang, Daqi Hu, Pengfei Wu, Yunbo Yang, Qingni Shen, and Zhonghai Wu. Sok: Understanding zk-snarks: The gap between research and practice, 2025. URL bttt::://arxxv.orgaabb/////
Tianyi Liu, Zhenfei Zhang, Yuncong Zhang, Wenqing Hu, and Ye Zhang. Ceno: Non-uniform, segment and parallel kero-nnoweddge virtual machine. Cryptology ePrint Archive, Paper 2024/387, 2024. URL
https://eprini: iacr. org/2024/377
Fucai Luo, Saif Al-Kuwari, and Yong Ding. Svil: Efficient secure aggregation and verification for cross-silo federated learning. IEEE Transactions on Mobile Computing, 23(1):850-864, 2024. doi: 10.I109/TMC.
2022.3219485.
Abbass Madi, Oana Stan, Aurélien Mayoue, Arnaud Grivet-Sébert, Cédric Gouy-Pailler, and Renaud Sirdey, A secure federated learning framework using homomorphic encryption and verifiable computing. In 2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS), pp. 1- 8, McMaster University, Hamilton ON, Canada, 2021. IEEE. doi: 10.1109/ D0.1109/DAAPS4412222 /RDAAP481126. 19445005.
Mary Maller, Sean Bowe, Markulf Kohlweiss, and Sarah Meiklejohn. Sonic: Zero-knowledge snarks from linear-size universal and updatable structured reference strings. In Proceedings of the 2019 ACM SIGSAC Conference Computer and Communications Security, CCS '19, pp. 2111-2128, 2128, New York, NY, USA, 2019. Association for Computing Machinery. ISBN 9781450367479. doi: 01114//33195553330 https://doi. wwt.ooggg//oo 10. 1145/33199955 3339817
URL
Mansouri Mohamad, Melek Önen, Wafa Ben Jaballah, and Mauro Conti. Sok: Secure aggregation based on cryptographic schemes for federated learning. In IACR (ed.), PETS 2023, 23rd Privacy Enhancing Technologies Symposium, 10-15 July 2023, Lausanne, Switzerland (Hybrid Conference), pp. 140-157, Lausanne, 2023. Rochester NY: Privacy Enhancing Technologies Board. IACR.
Eduardo Morais, Tommy Koens, Cocs Van Wijk, and Aleksci Koren. A survey on zero knowledge range proofs and applications. SN Applied Sciences, 1:1 17, 2019.
Ahmet Murat Ozbayoglu, Mehmet Ugur Gudelek, and Omer Berat Sezer. Deep learning for finan- cial applications : A survey, Applied Soft Computing, 93: 93:106384, 2020. ISSN 1568-4946. doi:
https:///cb..rr//0..01///...... www.asssc...000000 URL p11/$1568449660300224
Bryan Parno, Jon Howell, Craig Gentry, and Mariana Raykova. Pinocchio: Nearly practical verifiable computation. In 2013 IEEE Symposium on Security and Privacy, pp. 238 252, San Francisco, California, US, 2013. TEEE. doi: 10. 10.1109/5P.2013.47.
Agostinho Sousa Pinto, António Abreu, Eusébio Costa, and Jerónimo Paiva. How machine learning (ml) is transforming higher education: A systematic literature review. Journal of Information Systems Engineering and Management, 8(2):21168, April 2023. ISSN 2468-4376. doi: 10.55267 1112267/iadt.000 wtw......7.7.... 07.10277......
URL http:
7/dx. htt..ddd..rg/10.5557///1/3 07 13227
Nuria Rodriguez-Barrdn Barroso, Daniel Jiménez-López, M. Victoria Luzón, Francisco Herrera, and Eugenio Martínez- Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges. Information Fusion, 90:148 173, 2023. ISSN 1566-2535 doi: https:
//dbbtorg/100.111/j.nnfi 2002..9.22..0..... $1566253522001439
Timon Rickel, Johannes Sedlmeir, and Peter Hofmann. Fairness, integrity, and privacy in a scalable blockchain-basod federated learning system. Computer Networks, 202: 202:108621, 2022. ISSN 1389- doi: httpss///oo..rr//11100///////o
20010mmmmm2222111000211111111111 URL https://www httpp://wwr..cceccceeeee..o./o// cttp://ccccccccooccccccc/c//////
article//p1///1339122220001.
25

---

Published in Transactions on Machine Learning Research (06/2025)
César Sabater, Florian Hahn, Andreas Peter, and Jan Ramon. Private sampling with identifiable cheaters.
In 23rd Privacy Enhancing Technologies Symposium, pp. 361-383, 2023. doi: patp:///ppps2222255 23rd Privacy Enhancing Technologies Symposium, PETS 2023, Pets 2023 Conference date: 10-07-2023 Through 15-07-2023.
César Sabater, Aurélien Bellet, and Jan Ramon. An accurate, scalable and verifiable protocol for federated diffcrentially private averaging. Machine Learning, 111, 10 2022. doi: 10.1007/s109914-22-002222
István András Seres and Péter Buresi. Behemoth: transparent polynomial commitment scheme with constant
opening proof size and verifier time. Cryptology ePrint Archive, Paper 2023/670, 2023. URL https:
//eprint. iacr. www.rr.org/023//7777
https://eprint..iee iacr. orgg//23//7
Asadullah Tariq, Mohamed Adel Serhani, Farag Sallabi, Tariq Qayyun, Ezedin S. Barka, and Khaled A.
Shuaib. Trustworthy federated learning: A survey, 2023.
Justin Thaler. Proofs, arguments, and zero-knowledge. Foundations and Trends@ in Privacy and Security, 4(2 4(2-4):117-660, 2022. ISSN 2474-1558. doi: 00.1561/33000000 URL http::/dx..c doi http://d....i..r//....../... 1561/ 8300000030|
Georgia Tsaloli, Bei Liang, Carlo Brunetta, Gustavo Banegas, and Aikaterini Mitrokotsa. Deva: Decen- tralized, verifiable secure aggregation for privacy-preserving learning. In Information Security: 24th International Conference, ISC 2021, Virtual Event, November 10-12, 2021, Proceedings, pp. 296-319, Berlin, Heidelberg, 2021. Verlay. ISBN 978-3-030-91355-7 doi: 10.1007/978-3-030-911333 16. URL https:://oi.org::: http::///.....o///01000010116333 9001000000000000--------------1-
Huaimin Wang, Zibin Zheng, Shaoan Xie, Hong-Ning Dai, and Xiangping Chen. Blockchain challenges and opportunities: survey. International Journal of Web and Grid Services, 14:352 375, 10 2018. doi: 10.1504/IJWGS
7. Wang, N. Dong, J. Sun, W. Knottenbelt, and Y. Guo. zkfl: Zero-knowledge proof-based gradient aggre- gation for federated learning. IEEE Transactions on Big Data, PP(01):1 14, may 2024. ISSN 2332-7790. doi:
2024.3403370.
Zhang Wcnhua, Faizan Qamar, Taj-Aldeon Naser Abdali, Rosilah Hassan, Syed Talib Abbas Jafri, and Quang Ngoe Nguyen. Blockchain lechnology: Security issues, healthcare applications, challenges and future trends. Electronics, 12(3), 2023. ISSN 2079-9292, doi: 10.3390/electronie 12030546. URL https: 7/www. mdpi. wwt.:mdpppccopm0//m 022000999922221 12/2//12
Zhibo Xing, Zijian Zhang, Jiamou Liu, Ziang Zhang, Meng Li, Liehuang Zhu, and Giovanni Russello. Zero- knowledge proof meets machine learning in verifiability: A survey, 2023.
Guowen Xu, Hongwei Li, Sen Liu, Kan Yang, and Xiaodong Lin. Verifynet: Secure and verifiable federated learning. IEEE Transactions on Information Forensics and Security, 15:911 926, 2020. doi: 2019.2929409.
Xianglong Zhang, Anmin Fu, Huaqun Wang, Chunyi Zhou, and Zhenzhu Chen. A privacy-presers and ver- ifiable federated learning scheme. In ICC 2020 2020 IEEE International Conference on Communccttions (TCC), pp. 1-6, Online, 2020. TEEE. doi: 10.1 TT//TCC40027.2000.222 986228888888888..
Yanci Zhang and Hanyou Yu. Towards verifiable federated learning. In International Joint Conference on Artificial Intelligence, pp. 5693, Vienna, Austria, 2022. IJCAL. URL https://api. semanticscholar. wwwp:ccholaarrrg//oooooooo attgCorrpuID:2449055533
Jiaqi Zhao, Hui Zhu, Fengwei Wang, Rongxing Lu, Zhe Liu, and Hui Li. Pvd-fi: A privacy-preserving and verifiable decentralized federated learning framework. IEEE Transactions on Information Forensics and Security, 17:2059 2073, 2022. doi: 10. 1L1109/TTPS..222.3177111
Lingchen Zhao, Qian Wang, Cong Wang, Qi Li, Chao Shen, and Bo Feng. Veriml: Enabling integrity assurances and fair payments for machine learning as a service. IEEE Transactions on Parallel and Distributed Systems, 32(10):2524 2540, 2021. doi: 10.1109/TPDS.220 20.6610......
26

---

Published in Transactions on Machine Learning Research (06/2025)
Zibo Zhou, Zongyang Zhang, Zhiyu Zhang, and Jin Dong. Proof-carrying data from multi-folding schemes. Cryptology ePrint Archive, Paper 2023/1288 2023. URI. https://epriitt iacr www.:iiaarrrrroo.oo.ooo. org/2223//2222
Weiqin Zou, David Lo, Pavneet Singh Kochhar, Xuan-Back Dinh Le, Xin Xia, Yang Feng, Zhenyu Chen, and Baowen Xu. Smart contract development: Challenges and opportunities. TEEE Transactions on Software
Enginoering, (7(10):2084-2100 2021. doi:
2944331..
27


Reviews:
[{"review_id": "ybrAgo6K6h", "reviewer": "Reviewer_az79", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- The survey is well written and easy to understand\n- The analysis of ZKP for verifiable FL is very detailed \n- The proposed classification into four categories is clear and sound.\n\nWeaknesses:\n\n- The theoretical modeling and optimization of ZKPs feel somewhat disconnected from the rest of the paper. Strengthening the connection between these sections and the earlier taxonomy would improve the narrative flow.\n- The paper includes a large number of detailed tables, but only a single main figure. More visual summaries (e.g., comparative diagrams) would enhance readability.\n- There is some overlap between the taxonomy section and the subsequent ZKP analysis, which could be streamlined to reduce redundancy.\n- The scope may be too narrow. While the focus on cross-silo settings is well motivated, including a brief comparison with cross-device FL could improve the generalizability of the survey.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a comprehensive servey on verifiable FL in the context of context of cross-silo FL. The authors introduce a taxonomy that classifies existing approaches into four categories: Redundant Aggregation (RA), Homomorphic Property (HP), Zero-Knowledge Proof (ZKP), and Data Embedding (DE). The comparative analysis of ZKP with the focus on cost and scalability in FL contexts is also provided.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Add more visual figures or diagrams to summarize key comparisons and findings.\n- Improve the connection between the ZKP optimization analysis and the other part of the survey.", "broader_impact_concerns": "No.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "M4zJSEokr6", "reviewer": "Reviewer_dGgQ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n+ Trust in FL systems is an important aspect, especially in cross-silo settings, where the sensitivity of the tasks and the data in some applications require to have either a trusted aggregator, trusted participants, or both. The paper provides a comprehensive survey of different techniques addressing the specific challenges in cross-silo settings, and advocates for the advantages of some ZPK schemes compared to other approaches for FL verifiability. \n+ The taxonomy is very clear, and Figure 1 provides a very nice snapshot of the different group of approaches, techniques, and their intersection. The discussion also includes trade-offs among security, efficiency, and scalability, giving readers a deeper view rather than a superficial comparison. Tables 1 and 2 provide a nice overview of the characteristics of the techniques introduced in the survey. Similarly, the generic algorithms described in the paper are very helpful to understand better how the different families of techniques work. \n+ The argument in favor of ZKP-based techniques for verifiability of cross-silo FL seem reasonable and, the analysis in Section 4 provides a comprehensive analysis of the characteristics and requirements needed for applying ZKP techniques in these settings. \n+ The authors provided a nice discussion in Section 5, especially identifying some research gaps that can foster future research in this area. \n\nWeaknesses: \n+ The paper does not provide a detailed justification in its novelty and contributions with respect to previous surveys in FL verifiability, e.g., (Zhang & Yu, 2022; Tariq et al., 2023). For example, the authors could provide more details on what the novelty of the proposed taxonomy is compared to previous works or be more specific about how previous papers are missing the specific challenges in cross-silo applications. \n+ I think that the paper should provide a clearer distinction between different use cases: verifiability on the aggregator, the participants, or both. For instance, this could be introduced in Section 2.4. As this has implications across different aspects (e.g., threat model, scalability requirements, etc.), I think that making the distinction between different use cases clearer would help to improve the analysis and readability of the paper. \n+ Following the previous point, the threat models heavily depend on what entities are trusted or not and, depending on the scenarios some type of attacks can be available or not. In this sense, I think the paper lacks a clearer view on what type of attacks are possible depending on where verifiability is applied.  \n+ While the survey provides a nice conceptual framing, it lacks an empirical analysis, for example comparing some existing methods, which would help the readers to understand better the potential and limitations of these techniques. \n+ The paper does not mention or discuss any available frameworks, tools or benchmarks that could help researchers to evaluate verifiable FL techniques. On the other hand, the paper would benefit from discussing case studies or real-world FL systems where verifiability has been successfully implemented (or not). \n+ Although the privacy vs verifiability trade-off is acknowledged, it is not explored deeply in the paper. This is very relevant, as privacy can be a key requirement for some cross-silo applications of FL. It would be convenient to explore how to navigate this trade-off with examples or proposed frameworks.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper presents a comprehensive survey of techniques that enable verifiability in cross-silo Federated Learning (FL) systems, where depending on the scenario, participants or the aggregator may not be trusted. Thus, verifiable protocols allow to check that the computations of different entities do not deviate from the training procedure and perform the computations correctly. The contributions of the paper also include a taxonomy of existing methods for FL verifiability, considering the specific challenges of cross-silo settings; a comparison of different Zero Knowledge Proof (ZKP) analyzing their suitability in cross-silo FL; and a discussion of research gaps and challenges.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "+ More detailed justification of the novelty of the survey compared to previous works. For example, what are the differences with previous surveys in FL verifiability with respect of the proposed taxonomy? In which ways the previous surveys are not covering the specific challenges on verifiability in cross-silo FL?\n+ More detailed analysis of the threats that are available and those that are mitigated when using verifiability techniques in the server, the participants, or both. For example, in Section 2.3, how verification can prevent data poisoning attacks? If the data has been manipulated before commitment verifiability is of no use for preventing them. On the other hand, if verifiability is only applied in the aggregator, model poisoning attacks could still be possible. \n+ Deeper analysis on the privacy vs verifiability trade-off (see previous comments).\n+ It would be interesting to include available frameworks or tools for verifiable FL or present some case studies or real-world FL systems using verifiability. \n\nMinor questions: \n+ In Section 2.8 the authors say: “In this work, we primarily discuss Non-Interactive Zero-Knowledge (NIZK) proofs”. Why is that? Is this the only approach used for FL verifiability?\n+ In Section 4.1, for the CRS it would be convenient to be more explicit about the benefits of having a scheme with a universal reference string.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "PIyWlmD58k", "reviewer": "Reviewer_SDe5", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n* Clear and useful taxonomy that helps organize a diverse literature.\n\n* Strong technical depth in the comparison of protocol overheads (Tables 1 and 2).\n\n* The ZKP analysis is comprehensive, and the storage optimization section is original and well thought out.\n\n* Identifies real research gaps and future directions.\n\n**Weaknesses**\n\n* The survey doesn't touch much on practical deployment or implementation challenges.\n\n* Limited discussion of blockchain overheads (e.g., miner redundancy, latency, energy).\n\n* Threat model discussion could go deeper, especially around client-server collusion.\n\n* The interaction between verifiability and other goals like privacy and robustness is underexplored.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a detailed survey of verifiable cross-silo federated learning (FL) protocols. The authors introduce a taxonomy that groups existing methods into four main categories: redundant aggregation (RA), homomorphic property-based (HP), zero-knowledge proof-based (ZKP), and data embedding (DE). They provide comparative analysis of protocol efficiency and threat models, along with an in-depth section on ZKP schemes and how they can be optimized for FL settings. The paper ends with a discussion of open research questions.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "* Important: Add a short discussion on how privacy (e.g. differential privacy) limits what verifiability can detect. This is mentioned briefly but could be supported by recent formal results (see below).\n\n* Important: Include some qualitative discussion of real-world deployment barriers, especially for blockchain-based protocols.\n\n* Moderate: Clarify what types of collusion are out of scope and whether client interaction helps.\n\n* Minor: Provide practical suggestions or rules of thumb for selecting ZKP schemes depending on model complexity and training dynamics.\n\nOn the first point above: it may be worth discussing the following:\n\n[AGGPS, ICML '23] \"On the Privacy-Robustness-Utility Trilemma in Distributed Learning\"\n\n[AKFJG, ICML '24] \"The Privacy Power of Correlated Noise in Decentralized Learning\"\n\nThese works don’t focus on verifiability directly, but are relevant because they formalize how privacy constraints (like differential privacy) limit robustness and detectability of certain attacks (privacy and/or model poisoning). [AGGPS, ICML '23] gives lower bounds that are directly relevant to the point raised in Section 3.1 about privacy limiting the ability to detect poisoning. [AKFJG, ICML '24] studies correlated noise, which can be relevant in scenarios where verifiability relies on assumptions about randomness or independence across clients.\n\nA brief discussion of these results would help ground the survey’s claims about the tradeoffs between verifiability and privacy, and clarify the limits of what’s achievable. This isn’t critical for acceptance but would improve the paper.", "broader_impact_concerns": "No major concerns. A short Broader Impact section would help, especially to touch on risks of misuse (e.g., selectively verifying only favorable outcomes), and clarify that verifiability alone doesn’t eliminate all risks (e.g., privacy-compliant attacks).", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ebUa6wFb9L", "reviewer": "Reviewer_HNsx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Strengths: \n1. This survey tackles an important topic of verifiable FL, and positions it adequately in the cross-silo setting. \n2. This survey presents an extensive and detailed analysis on the threat models and complexities of existing works. \n\n# Weaknesses: \nI am not an expert in cryptography so I am not able to evaluate the correctness of this paper. Some minor comments include: \n- The authors can outline the overall process of FL + verification with some pseudocode to give readers an idea about when and where the verification process will kick in. \n- In the abstract, the authors mention 'FL is a .... with data distributed across multiple devices'. Since this paper tackles cross-silo FL, the authors may revise this statement.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a survey on verifiable cross-silo federated learning. The authors introduce some cryptographic backgrounds needed (e.g. blockchain, ZKP) and then provides a taxonomy to classify existing methods according to the threat models (honest, semi-honest, forger, malicious) and the methodology adopted (e.g. ZKP, HP, RA). The authors present an extensive analysis on the complexity (computation, communication) of existing methods.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See 'weaknesses'.", "broader_impact_concerns": "No.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)