## 1 Introduction
### Background and Related Work  
Confidentiality is critical to protecting machine learning (ML) systems, especially in ensuring the confidentiality, integrity, and privacy of materials and models during the learning process [23]. Two well-known methods, Homomorphic Encryption (HE) and Zero-Knowledge Proof (ZKP), play an important role in this field. Homomorphic encryption can perform operations on encrypted data without decryption, providing privacy protection [24; 25]. In a decentralized learning environment, especially in systems like split learning, HE ensures that the server or client cannot access the original data while performing collaborative learning [26]. Popular methods used in this case are CKKS (Cheon-Kim-Song) and BFV schemes, which provide addition and multiplication operations on encrypted material [27; 28]. This approach addresses one of the major privacy issues in ML: sharing private data with third parties and enabling computation [29]. Zero-knowledge proof (ZKP) allows one party (the adversary) to convince the other party (the offender) that the information is true without leaking the information [30]. In the context of machine learning, ZKP ensures computational accuracy without leaking underlying information. This is particularly useful in collaborative learning environments where groups must ensure that they successfully complete training without revealing their data and location to others [31]. ZKP has been successfully used in blockchain technology, privacy protocols, and now in ML systems to ensure reliability and anonymity [32]. These privacy mechanisms are crucial for protecting decentralized machine learning systems such as split learning and federated learning, where maintaining the privacy of multiple participants is crucial [33]. Layered learning (SL) is a distributed learning technology in which neural networks are distributed between clients and servers, enabling collaborative learning without the need for clients and servers to share data [34; 35]. The model is divided into \"shear layers\" where the client uses its data to make decisions, then sends the output to the server and completes the rest of the training [36; 37; 38]. This reduces software load on clients and multiple devices (e.g., mobile devices) and maintains data privacy since the server cannot access the information [39]. Despite its advantages, decentralized learning is vulnerable to many types of attacks, especially reverse attacks [40]. In a reverse attack, a malicious agent can exploit its local profile or model to make the global model disadvantageous for some inputs but beneficial for others. This attack is very dangerous in decentralized learning because a server managing many instances is considered good without checking client statistics [36; 41]. In addition, there are still concerns about data theft, especially if customer information is not properly protected, and fraud can be used to recover customer data from multiple sources [42]. Various defenses have been proposed to address security and privacy issues in distributed learning frameworks like Federated Learning (FL). One popular approach is Differential Privacy (DP), which ensures that individual data contributions cannot be inferred from the model outputs by adding noise to the data or the gradient updates [43]. While effective at providing privacy guarantees, DP can degrade model accuracy, especially in highly non-IID (non-independent and identically distributed) data settings, which are common in real-world distributed learning environments [44]. Secure Aggregation is another commonly used defense, particularly in FL. It ensures that client updates are aggregated in such a way that the server cannot see the individual updates, only the aggregated result [45; 46]. Secure aggregation methods have been shown to be vulnerable to poisoning attacks, where a malicious client can submit manipulated updates that are aggregated into the global model, leading to backdoor behaviors [47; 48].