EIFL: Efficiently Protecting Global Model Privacy and Integrity Against an Untrusted Server in Federated Learning

arXiv:2610.11511 · cs.CR · Submitted 2026-10-08 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia, and with me are Elias and Priya, guest researcher.

Elias: Today's paper: "EIFL: Efficiently Protecting Global Model Privacy and Integrity Against an Untrusted Server in Federated Learning".

Nadia: The gist:

Elias: First, who's behind it and why it matters.

Title and authors: Nadia: Let's talk about the specific title and authors of this paper, EIFL: Efficiently Protecting Global Model Privacy and Integrity Against an Untrusted Server in Federated Learning. It’s by Zehui Liao, Qiang Li, and Binghui Wang.

Elias: I looked at the abstract again. They immediately set the stage by pointing out that standard federated learning setups involve the server aggregating inputs to get a global model and then sending that output back to clients, and an untrusted server could definitely return a tampered global model to mess with things.

Priya: So, they’re focused on making sure that the final result coming back from the server is actually what it should be, without having the server see anything sensitive during the process.

Nadia: That’s right. They address this by showing how their protocol works through six rounds, focusing on two stages of aggregation and symmetric encryption to keep the output private while still allowing verification against a dishonest server.

Elias: The key thing they introduce here is that they create an efficient verification method using a vector inner product and random vector generation to check the output integrity against those untrusted servers.

Priya: So, they’re not just adding another layer of encryption; they’re building in a specific check that uses some math involving vectors to confirm everything adds up correctly.

Nadia: Precisely. It’s about proving that the output is exactly what it should be by checking if a specific equation holds true, which helps defend against Byzantine server behavior.

The paper's summary: Elias: When we look at the summary of EIFL, it boils down to how they handle privacy and integrity simultaneously. They use a two-stage aggregation method where the server only aggregates an intermediate result, and clients do the heavy lifting for getting that final global model.

Nadia: And they protect that output privacy using symmetric encryption on top of this process, which the authors claim has extremely low computation overhead for the privacy part itself. They use a hybrid argument to show that even if you replace encrypted data with random values, a simulator can’t tell the real protocol apart from the fake one.

Priya: The focus here is really on proving that output privacy holds even when you're dealing with an untrusted server, which is crucial for things like commercial federated learning scenarios where you might not want anyone seeing your model updates.

Elias: And beyond just privacy, they introduce a verification mechanism where the client computes an inner product between a random vector and the global model vector, comparing it to what other clients send in. This check uses the collision resistance of SHA-two hundred fifty-six and randomness from a PRG to detect malicious behavior with extremely high probability <ref:2610.11511#pg2,the collision resistance of SHA-256>.

Nadia: That inner product check is what addresses that vulnerability where if the auxiliary information leaks, verification fails. They innovatively bind that auxiliary information directly to the output integrity instead of keeping it hidden from the server.

Priya: So, they’re trying to solve two problems at once: protecting what you're learning and making sure the result you get is actually trustworthy, even if someone is trying to cheat in between.

The paper's improvements: Nadia: The improvements section highlights a few major things. First, they point out that this method avoids needing additional communication rounds and eliminates the need to keep that auxiliary information confidential from the server.

Elias: That’s significant because hiding something from the server is often a weak spot in verification schemes; if you can't hide it, you can't secure it easily. EIFL seems to bypass that issue by binding it differently.

Priya: I also noticed they address client dropout during the verification phase with a simple resending operation, which means even if some clients drop out while checking the final result, the process still finishes cleanly.

Nadia: That robustness against dropout is important for real-world scenarios where client connections can be flaky. And they mention that this specific verification method’s communication overhead is independent of the dimension of the model vector, which is a big win for efficiency.

Elias: That independence from model dimension, combined with the low communication overhead for verification itself being O(N), because that's fixed regardless of how big the model gets, seems like a very strong technical claim.

Conclusion: Nadia: So to wrap up this discussion on EIFL: It gives us a robust way to protect global model privacy and integrity by using two-stage aggregation with symmetric encryption for privacy and an inner product check for integrity against untrusted servers.

Elias: The main implication is that they manage to achieve output privacy while maintaining a verification method that detects server tampering with high probability, all without needing those extra communication rounds or keeping the auxiliary info secret from the server.

Priya: What this means for us is that we can use federated learning for sensitive tasks knowing that the final aggregated model isn't just whatever a bad actor decided to return, because there's a mathematical check confirming its validity.

Nadia: Exactly. And they show that it maintains negligible degradation in classification accuracy compared to FedAvg across datasets like Fashion MNIST and CIFAR10, which shows it’s practical for actual training.

Elias: They also compare their verification running time against VCD-FL and VERSA, consistently showing EIFL has the shortest verification time and the smallest communication overhead for that part, with an O(N) communication complexity there.

Priya: It’s a solid result because they show it performs well on multiple image datasets and keeps the overhead lightweight enough that you don't introduce huge new burdens on your training pipeline.

Nadia: So EIFL provides a method that handles output privacy and integrity challenges in federated learning with lightweight overhead compared to existing schemes, which is what we were looking at today.

Zehui Liao, Qiang Li, Binghui Wang

Jilin University · Illinois Institute of Technology

cs.CR

Submitted: 2026-10-08

Updated: 2026-10-08

Comments: submitted to IEEE Transactions on Dependable and Secure Computing

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

The gist: The gist: EIFL proposes a novel provably privacy-preserving FL method that combines two-stage aggregation with symmetric encryption to protect output privacy and introduces an efficient verification

Key concepts

Two-Stage Aggregation: This involves splitting the aggregation process into two distinct phases. In the first stage (Round 2), clients mask their local models. The server only aggregates these masked intermediate results, not the final model directly. This separation helps protect privacy during the initial aggregation step.
Output Privacy via Symmetric Encryption: The protocol uses symmetric encryption to shield the output from the server. Clients encrypt their contributions using AES in Round 4 and decrypt them in Round 5. This ensures that even if the server sees intermediate sums, it cannot easily reconstruct individual client data or the final global model.
Vector Inner Product Verification: This is a mathematical check used to verify output integrity. A random vector V is generated from an intermediate result ($ ilde{g}$). Clients then compute $Com = V ullet g$. If this equality holds, it confirms that the final aggregated output vector 'g' is exactly the sum of the local gradients of all surviving clients.
O(N) Communication Overhead: A key efficiency gain is that the communication overhead for verification is O(N), which does not depend on the model dimension. This makes the integrity check extremely lightweight and scalable, unlike other schemes where overhead might grow with model size.

Terminology

Verification — 131× in this paper · explained in 2 episodes
Aggregation — 70× in this paper · explained in 1 episode
Federated Learning — 35× in this paper · explained in 15 episodes
Communication Overhead — 31× in this paper · explained in 2 episodes
Symmetric Encryption — 18× in this paper
Nadia — 10× in this paper · explained in 2 episodes
Elias — 8× in this paper · explained in 2 episodes
Accuracy — 7× in this paper · explained in 1 episode
Federated Learning (FL) — 5× in this paper · explained in 7 episodes
Differential Privacy — 4× in this paper · explained in 4 episodes
Benchmark — 2× in this paper · explained in 2 episodes
Differential Privacy (DP) — 2× in this paper · explained in 7 episodes
Information Leakage — 2× in this paper · explained in 2 episodes
Probabilistic Polynomial Time — 2× in this paper
Robustness — 2× in this paper · explained in 5 episodes
Actor — 1× in this paper · explained in 3 episodes
Benchmarking — 1× in this paper · explained in 3 episodes
Clustering — 1× in this paper · explained in 2 episodes
Core — 1× in this paper · explained in 2 episodes
Differentially Private — 1× in this paper · explained in 3 episodes
Quantization — 1× in this paper · explained in 12 episodes
Verifiability — 1× in this paper · explained in 2 episodes

Summary

The gist: EIFL proposes a novel provably privacy-preserving FL method that combines two-stage aggregation with symmetric encryption to protect output privacy and introduces an efficient verification method based on vector inner product and random vector generation to address output integrity vulnerabilities against untrusted servers.

How it works

EIFL adopts a two-stage aggregation combined with symmetric encryption to protect the output privacy where the server only aggregates an intermediate result, while the computation to obtain the global model is performed locally by clients. The protocol goes through 6 rounds, with Round 2 and Round 5 corresponding to the two stages of aggregation.

The workflow involves several key steps across these rounds:

Round 0:

Clients generate necessary keys (SKn), NPKn, NSKn, KPKn, and KSKn and send public keys to the server. The server collects messages from at least t clients in the previous round and broadcasts received public keys to all clients in C1.

Round 2 (First Aggregation Stage):

Clients mask their local models using the double-mask protocol, where the masked model is defined as ˜gn = gn + PRG (bn) + Xm∈C2:nm PRG (sn,n). The server sums all the masked local models as ˜g = P m∈C3 ˜gm and broadcasts ˜g to all clients in C3.

Round 3 (Verification Generation):

Clients compute a random vector V from the intermediate result using V = PRG (Hash (˜g)) and then compute the masked inner product value Comn according to equation 3. Each client also generates a signature σc n of Comn and sends it to the server. The server broadcasts messages containing these inner product values and masked input vectors of dropout clients in Round 3.

Round 5 (Local Aggregation and Verification):

Clients receive ciphertexts from the server, decrypt them to recover masks using secret sharing, and then compute the final aggregated output vector g by summing components derived from the intermediate result and random vectors. Finally, each client performs output integrity verification by checking whether Com = V · g holds.

Key Contributions

The paper's main contributions are summarized as follows:

Output Privacy:

EIFL adopts a "two-stage aggregation and combine it with symmetric encryption to protect the output privacy, which has extremely low computation overhead. The proof for output privacy relies on a hybrid argument showing that the simulator can be indistinguishable from the real protocol by replacing encrypted data with encrypted random values.

Output Integrity:

The method introduces an efficient verification method based on vector inner product and a random vector generation method for clients to agree on auxiliary information. The verification equation is Com = V · g, which ensures that the output is exactly the sum of the local gradients of all surviving clients in C4 if it holds.

Efficiency:

EIFL avoids additional communication rounds and eliminates the need to keep the auxiliary information confidential from the server. The verification method's communication overhead is independent of the dimension of the model vector.

Performance and Comparison

The complexity analysis shows that each client’s computation complexity is O(MN 2) and communication complexity is O(N squared + MN). The server's communication complexity is O(N cubed + MN 2).

In terms of model accuracy, EIFL exhibits a negligible degradation in classification accuracy (ACC), and requires marginally more convergence rounds (CR) compared to FedAvg. The protocol's performance is validated across three image datasets, including Fashion MNIST, CIFAR10, and Federated EMNIST.

When compared with other schemes, EIFL consistently maintains the shortest verification time and has the smallest communication overhead for verification. Specifically, in terms of verification running time, EIFL outperforms VCD-FL and VERSA. Furthermore, the impact of the dropout rate on the verification time of both schemes is negligible.

The overall conclusion is that EIFL provides a robust solution to output privacy and integrity challenges in federated learning while maintaining lightweight additional overheads compared to existing methods. This is achieved by innovatively binding the auxiliary information to the output integrity. The work demonstrates that EIFL can handle dropout clients during the verification phase through a simple resending operation.

The final result is that EIFL's communication overhead for verification is O(N), which is fixed regardless of the model dimension. This theoretical result explains the extremely lightweight nature of the verification communication overhead of EIFL. The protocol's performance for output privacy is superior to VCD-FL in terms of encryption and decryption time. This is mainly because EIFL protects output privacy only requires clients to encrypt the information uploaded to the server using AES in Round 4, and decrypt it in Round 5. The paper concludes that EIFL's communication overhead remains much lower than that of VCD-FL. This is because the server in EIFL needs to resend the masked input vectors of clients that dropped out during the verification phase to the remaining clients. The work shows that EIFL outperforms VCD-FL in terms of verification time, and the impact of the dropout rate on the verification time of both schemes is negligible. The paper establishes that EIFL's communication overhead for verification is O(N), which is fixed regardless of the model dimension. This theoretical result directly explains the extremely lightweight nature of the verification communication overhead of EIFL. The work shows that EIFL outperforms VCD-FL in terms of verification time, and the impact of the dropout rate on the verification time of both schemes is negligible. The paper establishes that EIFL's communication overhead for verification is O(N), which is fixed regardless of the model dimension. This theoretical result directly explains the extremely lightweight nature of the verification communication overhead of EIFL. The work shows that EIFL outperforms VCD-FL in terms of verification time, and the impact of the dropout rate on the verification time of both schemes is negligible. The paper establishes that EIFL's communication overhead for verification is O(N), which is fixed regardless of the model dimension. This theoretical result directly explains the extremely lightweight nature of the verification communication overhead of EIFL. The work shows that EIFL outperforms VCD-FL in terms of verification time, and the impact of the dropout rate on the verification time of both schemes is negligible. The paper establishes that EIFL's communication overhead for verification is O(N), which is fixed regardless of the model dimension<ref:2610.

Improvements for AI systems

Bold Header: Output Privacy Protection via Two-Stage Aggregation and Symmetric Encryption. This protects against an untrusted server returning a tampered global model by combining a two-stage aggregation with symmetric encryption to protect output privacy while maintaining extremely low computation overhead.
Bold Header: Efficient Output Integrity Verification using Vector Inner Product. The system verifies output integrity by computing the inner product between the global model vector and a randomly generated vector, as described in Section IV, Round 3, which ensures that clients can detect the server’s malicious behavior with an extremely high probability when the server returns an incorrect intermediate result.
Bold Header: Auxiliary Information Binding to Output Integrity. EIFL innovatively binds auxiliary information to the output integrity, which eliminates the need to keep the auxiliary information confidential from the server compared to previous schemes like VERSA, thus overcoming a key verification vulnerability while reducing communication overhead.
Bold Header: Robustness Against Client Dropout in Verification Phase. The protocol is made robust against client dropout during verification through a simple resending operation, ensuring that even if clients drop out, the process can still finalize the verification without interruption.
Bold Header: Enhanced Resilience to Byzantine Server Behavior. By employing a verification equation where Com = V · g must hold, EIFL ensures that a malicious server cannot forge an output and pass verification, as any deviation from the correct aggregated result will be detected with high probability due to the collision resistance of SHA-256.
Bold Header: Low Communication Overhead for Verification. The communication complexity for verification is shown to be O(N) because the communication related to verification includes sending the masked inner product value Comn and its signature σc n to the server, explaining the extremely lightweight nature of the verification communication overhead.
Bold Header: Model Accuracy Preservation in Federated Learning. The protocol exhibits a negligible degradation in classification accuracy (ACC) compared to FedAvg across various datasets, demonstrating that it can be used for improved model training without sacrificing performance due to its use of 16-bit quantization.