Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation

arXiv:2511.10863 · cs.CR · Submitted 2025-11-14 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia, and with me are Elias and Priya, guest researcher.

Elias: Today's paper: "Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation".

Nadia: Armadillo presents a secure aggregation system designed for federated learning that achieves disruptive resistance against adversarial clients by integrating input validation techniques.

Elias: First, who's behind it and why it matters.

Paper summary: Nadia: So, we're looking at this paper, "Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation," and it claims to tackle a big problem in federated learning where you have one powerful server dealing with many clients who might be malicious.

Elias: Exactly, Nadia; the core thesis seems to be that they've found a way to achieve disruptive resistance against adversarial clients by integrating input validation techniques into the system.

Priya: From a privacy and measurement standpoint, I'm interested in what this actually means for the data we are training on; does it really guarantee that the server only learns the sum of inputs?

Nadia: That’s right, Priya; they formally guarantee that privacy, meaning the server at most learns the sum of inputs from clients and nothing else. It's proven against a specific threat model where an honest-but-curious server colludes with a subset of clients below a certain threshold.

Elias: And what about robustness? The abstract mentions disruptive resistance, suggesting that even if clients try to mess with the aggregation, the server still gets the sum.

Priya: That robustness is key; they show that Armadillo ensures the server gets the correct sum no matter how clients passively drop out or actively disrupt it by misreporting their inputs within a pre-defined legitimate range.

Nadia: It seems like they've managed to do this in just three rounds, which is a major claim when you look at existing solutions that often require many rounds or high per-client costs.

Elias: That round complexity reduction is what really stands out; it cuts down the communication rounds significantly compared to prior work.

Priya: And I see they've also integrated existing input validation techniques into this system, which is interesting because it makes the disruption resistance complete.

Nadia: Right, Priya; that integration means each client has to prove that every step of its execution was done correctly and the server verifies those proofs using inner-product relations.

Elias: The mechanism for achieving this robustness involves sampling a set C of clients as "decryptors" to assist with unmasking, and each client uses packed secret sharing to share its secret vector.

Priya: That sounds like a clever way to reduce the communication complexity from quadratic down to linear in client size by using these decryptors.

Nadia: And this efficiency translates into a real-world speedup; they claim this reduction in round complexity leads to about three–four times fewer communication rounds and up to a seven times improvement on the computing time for just getting the sum.

Elias: That waiting time reduction is significant, especially when you consider how much time dominates the end-to-end run for these kinds of federated learning tasks.

Priya: So, what's the real implication here? If we can make aggregation this robust and efficient, it means we can deploy more complex models across a wider variety of clients without worrying as much about malicious interference during the training process.

Paper summary: Nadia: Precisely, Priya; it moves the practical applicability of secure aggregation from theoretical settings to something that's much more feasible for real-world deployments involving many weak clients interacting with one strong server.

Elias: Regarding the parameters, I'm curious if there are any specific conditions under which this protocol might break down or require very specific choices for its security parameters.

Nadia: That’s a fair question, Elias; we need to look closely at the formal security guarantees to see what those parameter assumptions actually are.

Priya: From a measurement perspective, the results show that for 1K clients, where ACORN-robust takes ninety to one hundred thirty seconds of waiting time, Armadillo finishes in just twelve seconds.

Nadia: That comparison really hammers home how much the speed advantage translates into tangible performance gains during actual training runs.

Elias: The paper does give us some concrete data on the costs, showing that for 1K clients, the cost for per-decryptor computation is cheaper than that of regular clients even when you factor in the time it takes to compute those norms.

Priya: That cost analysis is important because it shows this isn't just a theoretical improvement; it has a tangible computational benefit when we consider the entire process.

Nadia: It seems the authors have done a good job of balancing security, robustness, and efficiency in this Armadillo system.

Elias: Indeed, Nadia; they’ve managed to integrate input validation seamlessly while maintaining strong privacy guarantees under those specific conditions mentioned in Theorem one.

Priya: Looking forward, I think the real impact will be seen as we move towards training models on more sensitive data where the risk of adversarial clients dropping out or actively disrupting the sum becomes a much bigger concern.

Nadia: That’s what I was thinking; this work provides a more practical path for deploying secure aggregation systems in federated learning environments that are already widely used.

Elias: The system’s reliance on simple arithmetic computation via key-and-message homomorphic encryption, while efficient, also sets some constraints on the types of computations that can be performed securely within this framework.

Priya: That’s a necessary caveat; we need to remember that this protocol is optimized for specific aggregation tasks where those arithmetic operations are feasible.

Nadia: So, to wrap up on this paper "Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation," the main point is its success in achieving strong privacy and robustness in just three rounds with input validation.

Elias: And the authors' work points toward a future where these types of secure aggregation methods become a practical standard in federated learning deployments.

Priya: I think this work gives us a very solid foundation for exploring how to handle client uncertainty while keeping privacy intact in large-scale distributed training scenarios.

Conclusion: Elias: The title itself is pretty descriptive; it clearly sets expectations by mentioning both robustness and input validation in a single-server setup. I'm looking at the authors because they’re tackling a problem where existing systems often have to choose between privacy and resilience, and this one seems to try to bridge that gap directly.

Priya: From my side, I'm really interested in what this means for the actual training data; it suggests that we can deploy these aggregation schemes more confidently in scenarios with a lot of unpredictable clients. It moves the conversation away from just theoretical security bounds toward practical deployment stability.

Nadia: So, if we boil it down, Armadillo is aiming to give federated learning on a single server a reliable way to get accurate sums even when some participants are being intentionally disruptive. How does this change the landscape for real-world applications?

Elias: It changes the landscape by simplifying the required infrastructure; instead of needing complex multi-server setups or excessively long communication rounds, we can achieve strong privacy guarantees in just three rounds. That's a big win for system design.

Priya: I think that efficiency is where the real impact lies; when you look at how much time these protocols save, it translates directly into faster model training cycles for everyone involved. That speed could be important when dealing with large datasets and complex models.

Nadia: Exactly, Priya; the speed gain isn't just an academic metric; it affects how quickly we can iterate on our machine learning models. Elias, thinking about the constraints mentioned in the paper, what's the biggest practical hurdle we need to keep in mind when deploying this?

Elias: The paper does point out that this specific protocol is optimized for certain types of arithmetic computations; if your training involves operations outside those bounds, you might have to adapt or use a different approach. That's where the parameter assumptions become important for you.

Priya: And from a measurement standpoint, I’d like to see more data on how this holds up when the client input vectors get really long, say into the millions of dimensions they mentioned. Does that efficiency hold up as complexity increases?

Nadia: That's exactly what we need to test; if it scales well with vector length, then the implications for training massive models are much broader than just small-scale examples. It’s about whether this framework is truly scalable for industrial applications.

Yiping Ma★, Yue Guo, Harish Karthikeyan, Antigoni Polychroniadou

University of Pennsylvania · J.P. Morgan AI Research and AlgoCRYPT CoE

cs.CR

Submitted: 2025-11-14

Updated: 2026-09-26

Code: https://github.com/abides-sim/abides

Project page: https://jbootle.github.io/Misc/pippenger.pdf

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 91/100

The gist: Armadillo presents a secure aggregation system designed for federated learning that achieves disruptive resistance against adversarial clients by integrating input validation techniques.

Key concepts

Simple Two-Layer Secure Aggregation Protocol: This protocol uses a key-and-message homomorphic encryption scheme. The server first sums encrypted inputs (outer layer) and then aggregates the keys to decrypt the final sum (inner layer). This structure allows for secure computation without revealing individual client data.
Disruption Resistance: This property ensures that even if some clients drop out or actively try to disrupt the aggregation, the server can still reliably compute the correct sum. Malicious clients are limited in how much they can affect the result.
Input Validation Integration: Armadillo combines existing input validation techniques with its security protocol. Clients must prove that their execution steps were correct, and the server verifies these proofs using inner-product relations to ensure robustness against malicious behavior.

Terminology

Aggregation — 144× in this paper · explained in 1 episode
Federated Learning — 51× in this paper · explained in 14 episodes
Robustness — 31× in this paper · explained in 5 episodes
Verifier — 19× in this paper · explained in 2 episodes
Verification — 17× in this paper · explained in 2 episodes
Nadia — 16× in this paper · explained in 2 episodes
Elias — 15× in this paper · explained in 2 episodes
Aggregation Function — 3× in this paper · explained in 1 episode
Core — 3× in this paper · explained in 2 episodes
Actor — 2× in this paper · explained in 3 episodes
Benchmark — 2× in this paper · explained in 2 episodes
Communication Overhead — 2× in this paper · explained in 2 episodes
ACM Conference on Computer and Communications Security — 1× in this paper
ACM Symposium on Theory of Computing — 1× in this paper
Accuracy — 1× in this paper · explained in 1 episode
Adversarial Model — 1× in this paper · explained in 1 episode
Benchmarking — 1× in this paper · explained in 3 episodes
Consistency — 1× in this paper · explained in 3 episodes
Differential Privacy — 1× in this paper · explained in 4 episodes
Differentially Private — 1× in this paper · explained in 3 episodes
Hamming Distance — 1× in this paper · explained in 2 episodes
Quantization — 1× in this paper · explained in 12 episodes
Special Honest Verifier Zero Knowledge — 1× in this paper

Summary

Armadillo presents a secure aggregation system designed for federated learning that achieves disruptive resistance against adversarial clients by integrating input validation techniques. This work is significant because it addresses the gap in existing single-server aggregation schemes, which typically suffer from high per-client costs or require excessive rounds to tolerate malicious participants. Armadillo provides an efficient system that guarantees privacy and robustness in just three rounds, making it practical for real-world federated learning deployments where a single powerful server interacts with many weak clients.

Technical Contributions

The authors introduce two key design ideas to achieve lightweight clients and servers:

A simple two-layer secure aggregation protocol that relies on simple arithmetic computation. This protocol uses a key-and-message homomorphic encryption scheme where the server first sums encrypted inputs (outer layer) and then performs an aggregation on the keys to decrypt the sum (inner layer).
An agreement protocol that removes the effect of malicious clients from the aggregation with low round complexity.

Formal Security Guarantees

Armadillo guarantees two primary properties for a single aggregation:

Privacy: The server learns at most the sum of inputs from clients but nothing else. This is proven against an honest-but-curious server who colludes with a subset of clients (the same threat model as ACORN-robust).
Robustness (Disruption Resistance): The protocol ensures that the server is ensured to get the sum regardless how clients passively drop out or actively disrupt the aggregation, meaning a malicious client can only affect the result by misreporting their private inputs in a pre-defined legitimate range.

Protocol Design and Efficiency

The protocol is structured around reducing long-vector aggregation to short-vector aggregation using Regev’s encryption. The process involves:

Client i sending an encrypted vector: yi = A · si + ei + Δ · xi mod q.
Server computing the outer aggregation by summing these ciphertexts and then performing the inner aggregation on the keys to reconstruct the sum of inputs, provided that "Íni=1 ei < Δ/2."

To reduce communication complexity from quadratic to linear in client size, Armadillo employs:

Sampling a set C from N clients as decryptors to assist with unmasking.

Each client using packed secret sharing to share its secret vector si with the decryptors.

Round Complexity and Runtime Improvement

Armadillo achieves a significant reduction in round complexity compared to prior works. While ACORN-robust requires 6 + O(log n) rounds, Armadillo completes each secure aggregation in only 3 rounds regardless of the number of clients. This reduction is crucial because round complexity is critical for end-to-end run time, leading to a 3–4× improvement on the number of communication rounds and up to a 7× improvement on the run time for computing a sum. The overall runtime benefit is amplified by this round reduction, as waiting time dominates the end-to-end runtime.

Integration with Input Validation

A key feature is the seamless integration of existing input validation techniques. Robustness (Definition 3) is achieved when Armadillo seamlessly integrate[s] with existing efficient input validation techniques [30], resulting in a complete disruption-resistant system. This involves:

Each client proving that every step of its execution has been done correctly and the server verifies the proof.

The protocol uses inner-product relations, where commitments to vectors are checked using systems like Bulletproof. The cost for proving norms (L2 and L∞) is summarized in Lemma 1, showing costs dominated by inner-product proofs.

Evaluation and Results

Benchmarks show that Armadillo's server computation remains on par with the best prior work ACORN-robust, while its round complexity advantage yields substantial performance gains. For instance, for 1K clients, ACORN-robust incurs 90–130 seconds of waiting time, whereas Armadillo takes only 12 seconds. This demonstrates that waiting time is the dominant factor in end-to-end runtime, leading to a 5–7× improvement when total time including computation is considered. The system is optimized for small-scale models, with client input lengths up to a million. The cost for per-decryptor computation is shown to be cheaper than that of regular clients even when including proof of norm computation time.

Conclusion and Future Work

Theorem 1 formally states the properties of Armadillo, confirming that under specific parameter conditions, the protocol realizes ideal functionality Fsum (privacy and robustness) in the presence of a semi-honest adversary controlling the server.

Improvements for AI systems

Based on the scientific paper Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation, here are the specific improvements that can be made to AI systems, and what those improved systems will be capable of:

)1. Robust Privacy Guarantees Against Malicious Clients in Single-Server FL

The Armadillo system provides a robust framework for secure aggregation even when a single server is untrusted and up to a fraction of clients are malicious.

An AI system can securely aggregate model updates (gradients or weights) from thousands of weak, potentially adversarial edge devices (clients) onto one central server without the server learning any individual client's private data.
The system guarantees that even if a coalition of malicious clients misreports their inputs within a tolerated threshold, the final aggregated result remains mathematically consistent and correct.

)2. Resilience Against Client Dropouts and Passive Failures

The protocol is explicitly designed to handle passive dropouts (clients stopping mid-protocol) without aborting the entire aggregation process.

AI training pipelines can maintain high throughput and reliability by tolerating intermittent connectivity issues or device failures in a large participant pool. The system ensures that the server can still reconstruct the sum of inputs from all remaining online clients, provided the dropout rate stays below a specific threshold (e.g., 1/3 for certain settings).

)3. Seamless Integration of Input Validation for Enhanced Robustness

Armadillo integrates existing, efficient input validation techniques directly into its disruption resistance paradigm.

AI systems can implement input validation checks during aggregation (e.g., ensuring model weights conform to expected bounds or distributions). This allows the system to seamlessly detect and reject malicious inputs while still maintaining the overall robustness guarantee against active disruptions, leading to a more complete disruption-resistant system than those that only abort upon detection.

)4. High Efficiency and Low Round Complexity for Real-Time Learning

The protocol achieves robust security in just 3 rounds, which is significantly lower than prior state-of-the-art protocols that require many rounds (e.g., 10+ rounds).

This drastically reduces the end-to-end latency of federated learning training iterations. AI models can be trained much faster on resource-constrained devices because the communication overhead and synchronization time (waiting for clients) are minimized, making deployment on mobile or edge devices more practical.

)5. Computationally Lightweight Design for Clients and Servers

The system is designed to be computationally lightweight, utilizing simple arithmetic operations in the two-layer secure aggregation protocol and relying on efficient inner-product proofs.

AI training can be performed efficiently on a wide variety of heterogeneous hardware (from low-power mobile CPUs to moderate servers) because the computational load imposed on clients and the server remains manageable, even for high-dimensional model vectors.

)6. Scalable Performance with Optimized Proof Verification

The system utilizes optimized techniques like batch verification for inner-product proofs and specialized multi-exponentiation algorithms (Pippenger algorithm).

As the number of clients increases, the server's computation time remains manageable because proof verification costs decrease due to batching optimizations. This allows AI systems to scale to larger participant pools without incurring prohibitive server processing bottlenecks during the aggregation phase.

)7. Precise Norm Constraints for Model Quality Control

The protocol allows for rigorous mathematical constraints on the aggregated inputs (e.g., bounding the L2 and L∞ norms of the client vectors).

AI systems can enforce quality control or safety constraints by ensuring that aggregated model updates adhere to specific norm bounds during training, effectively mitigating attacks like poisoning where malicious clients try to inject excessively large or extreme updates.

Abstract

This paper presents a secure aggregation system Armadillo that has disruptive resistance against adversarial clients, such that any coalition of malicious clients (within the tolerated threshold) can affect the aggregation result only by misreporting their private inputs in a pre-defined legitimate range. Armadillo is designed for federated learning setting, where a single powerful server interacts with many weak clients iteratively to train models on client's private data. While a few prior works consider disruption resistance under such setting, they either incur high per-client cost (Chowdhury et al. CCS '22) or require many rounds (Bell et al. USENIX Security '23). Although disruption resistance can be achieved generically with zero-knowledge proof techniques (which we also use in this paper), we realize an efficient system with two new designs: 1) a simple two-layer secure aggregation protocol that requires only simple arithmetic computation; 2) an agreement protocol that removes the effect of malicious clients from the aggregation with low round complexity. With these techniques, Armadillo completes each secure aggregation in 3 rounds while keeping the server and clients computationally lightweight.