BlindFL: Segmented Federated Learning with Fully Homomorphic Encryption

Aurora Hook; Evan Gronberg; Liv d'Aliberti; Magnus Saebo

REVIEW 3 major objections 5 minor 46 references

BlindFL: Segmented Federated Learning with Fully Homomorphic Encryption

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read BlindFL claims that in FHE-based federated learning, clients can send only a randomly chosen subset of their model's parameter matrices—encrypted under CKKS—and the server can still build an accurate global model while spending roughly…

desk verdict The efficiency results are solid and useful; the security claims need a revised threat model that accounts for the trusted key distributor, which is currently load-bearing and unanalyzed. read the letter →

arxiv 2501.11659 v1 pith:NTEFQQKM submitted 2025-01-20 cs.CR

Evan Gronberg , Liv d'Aliberti , Magnus Saebo , Aurora Hook This is my paper · ORCID

classification cs.CR

keywords federatedlearningfullyhomomorphicencryptionclientmodelsegmentationgradientinversionattackspoisoningsecureaggregationCKKSkeydistribution

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BlindFL is a federated-learning framework that combines fully homomorphic encryption (FHE) with client model segmentation (CMS): instead of encrypting and sending the full local model, each client encrypts and sends a randomly requested subset of its parameter matrices to the server. The paper argues that this preserves the full-encryption guarantee of FHE-based aggregation—the server only ever sees ciphertexts and computes the weighted average homomorphically—while cutting per-client transmission and server-side aggregation time roughly in half, with no meaningful loss in global model accuracy on MNIST and CIFAR-10. A second claim is that segmentation also defends against a threat that single-key FHE schemes have not addressed: malicious clients who poison the global model to isolate and reconstruct other clients' data with gradient-inversion attacks. The authors support this both with a sensitivity-based argument (leaked information falls linearly with the fraction of layers available) and with experiments showing a much sharper, approximately exponential drop in reconstruction quality as the fraction of sent layers decreases. If these claims hold, operators of FHE-based federated learning can choose a CMS operating point to trade efficiency and protection without sacrificing convergence accuracy.

What carries the argument

The load-bearing mechanism is client model segmentation (CMS), implemented through a randomized request matrix $R$ generated by the server: for a model with $M$ parameter matrices and $c$ selected clients, the server chooses $p$ (the number of client matrices to average per global matrix) and generates $c$ binary rows of length $M$ such that every column has at least $p$ ones, then each client encrypts exactly the requested matrices under CKKS FHE and sends them. The server homomorphically computes the FedAvg-style weighted average per matrix, a key distributor (KD) issues a fresh public key at each round and releases the private key to clients only after server aggregation completes, and clients decrypt the returned global model. The security argument also runs through a per-layer sensitivity metric: if each layer's sensitivity is an identically distributed random variable, the expected total sensitivity of an attacked gradient is linear in the fraction $n/N$ of layers available, so shrinking the sent subset reduces the information a gradient-inversion attack can exploit.

What would settle it

Let the key distributor collude with the server for one aggregation round and attempt any state-of-the-art gradient-inversion attack on the decrypted client updates; if the server reconstructs a client's training data, the paper's server-side privacy claim is refuted.

Watch

Extended reading notes

Core claim

The central discovery is that the server does not need every client's full model update to build an accurate global model under FHE. By having the server request, per round, a random subset of each client's parameter matrices (designed so that every global matrix is still an average of at least $p$ client matrices), BlindFL keeps the aggregation fully encrypted and the global model's accuracy statistically indistinguishable from plain FedAvg, while reducing the amount of encrypted data in transit and the server's homomorphic workload. The paper further claims that this segmentation provides a new line of defense against malicious-client gradient-inversion attacks: an attacker who poisons the global model can only recover the gradient of the victim's update restricted to the subset of layers that were actually sent, and the information available for inversion falls as that subset shrinks, which the authors quantify with a per-layer sensitivity metric and by direct GIA reconstruction experiments.

Load-bearing premise

The paper's privacy guarantee assumes the key distributor (KD) is honest and uncorrupted: the KD holds the private key and releases it to every client after each round, so a malicious or colluding KD would hand the server plaintext updates and the claimed zero-leakage protection would fail.

Editorial extensions

If this is right

Operators of FHE-based federated learning can cut server-side aggregation time roughly in half and reduce per-client encrypted transmission by sending about 50% of parameter matrices, while keeping test accuracy within about 0.1–1.5 points of plain FL on the evaluated models.
CMS turns the privacy/efficiency dial: choosing a smaller fraction $n/N$ of shared layers weakens client-to-client gradient-inversion attacks (reconstruction quality drops sharply below $r \approx 2/3$) while still converging to a usable global model.
The per-round key-distribution protocol preserves the 0-differential-privacy guarantee against a server-side adversary who only sees ciphertexts, as long as the key distributor is honest and uncorrupted.
BlindFL is presented as the first single-key, FHE-based FL scheme that explicitly addresses malicious-client attacks rather than only honest-but-curious server adversaries.
Recommended operating parameters follow from the experiments: $r \le 2/3$ and $p \approx C/2$, which yields $c \ge \lceil p/r \rceil$ clients contributing per global matrix.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The strongest unexamined assumption is the key distributor's honesty: since the KD releases the private key every round and the threat model does not include a malicious or colluding KD, the server-side privacy guarantee collapses if that node is compromised; a natural hardening is threshold or multiparty key release.
The defense against malicious clients currently relies on random layer selection; a targeted adversary that chooses which layers to poison or omit might evade the statistical protection, so testing CMS under adaptive layer-selection attacks is a direct next step.
The efficiency numbers come with a caveat: because each parameter matrix is encrypted individually, models with many small matrices (like ResNet-20) see a larger FHE expansion factor than models with few large matrices, so the practical gain from segmentation is architecture-dependent.
The paper's suggested future direction—selecting segments by layer sensitivity instead of uniformly at random—could plausibly steepen the drop in GIA success at the same transmission cost, which would turn the current worst-case protection into a tunable one.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper is worth sending to review, but only after the authors fix the threat model. The efficiency half holds up; the security half does not.

What's new: BlindFL is a clean combination of FHE and random layer-level segmentation for single-key FL, with a specific balanced request-matrix algorithm. The simulations on MNIST and CIFAR-10 show server aggregation time roughly halved and per-client encrypted payload cut in half, with accuracy within about 1% of full-model FHE. That is a real, practically useful result for edge FL. The client-side poisoning defense is less novel than claimed—it is essentially an application of the sensitivity argument from Mo et al. [28]—but the experimental evaluation against the Geiping GIA is honest and shows a clear drop in PSNR/SSIM as layers are removed.

The defects are concentrated in the security argument. Section 5 claims 0-differential privacy against the server, citing prior FHE-FL work. But Protocol 1 introduces a key distributor (KD) that holds the private key and sends it to every client each round. The threat model in Section 2.3 never considers a malicious or colluding KD. If the server colludes with a single client, it gets the private key and can decrypt every ciphertext. That breaks the central privacy claim. This is not a minor omission; it is load-bearing. The paper needs either threshold decryption, distributed key generation, or an explicit and argued trust anchor for the KD.

Second, the "theoretical" client-to-client guarantee is just E[S'] = (n/N)E[S] under an i.i.d. sensitivity assumption, which the paper itself notes is weaker than the observed exponential decay. The exponential result may be true, but it is empirical, not derived. Also, the recommended r <= 2/3 threshold is read off the same experiments used to validate the defense. No code, data, or error bars are shipped.

Third, the paper cites FedSHE [30], which does adaptive segmented CKKS HE, but never compares to it or explains what is actually different. That weakens the novelty claim.

Who it's for: practitioners who want FHE-based FL with lower overhead. The efficiency data is useful even if the security analysis is incomplete.

Recommendation: send to peer review, but require a revised threat model that includes or rules out a malicious KD, and a discussion of the FedSHE relationship. The efficiency results are solid enough to justify a round of major revision.

Referee Report

3 major / 5 minor

Summary. The manuscript introduces BlindFL, a federated learning protocol in which each client encrypts a randomly selected subset of its local model parameter matrices with single-key CKKS FHE and sends them to a central server for weighted aggregation; a new key distributor (KD) node generates fresh FHE keys each round and releases the private key to clients after aggregation. The authors claim that this 'client model segmentation' (CMS) reduces per-client bandwidth and server-side aggregation time relative to full-model FHE FL, preserves global model accuracy on MNIST/LeNet-5 and CIFAR-10/ResNet-20, and provides a first single-key FHE-based defense against malicious-client gradient inversion attacks. The paper contributes algorithms (request and response matrix generation, aggregation, key distribution protocol), a Section 5 sensitivity analysis that predicts linear degradation of gradient leakage with the fraction of layers sent, and experiments (Tables 4-9; Figures 11-14) supporting the efficiency and GIA-resistance claims.

Significance. If the claims hold, BlindFL would be a practically relevant contribution: it offers a simple layer-segmentation knob that cuts FHE FL costs roughly in half with little accuracy loss, and it is one of the few single-key FHE FL schemes that explicitly attempts client-side poisoning defense. The cost measurements in Tables 4-9 are concrete and the accuracy results are reported over 5-trial averages across multiple client counts. The strongest part of the paper is the empirical efficiency evaluation; the weakest is the security analysis, which relies on an unmodeled trusted key distributor and on a sensitivity expectation that is not formally connected to attack success. The client-side defense results are promising but are presented with a 'theoretical demonstration' that is currently only a heuristic supported by the same experiments used to select the r<=2/3 threshold.

major comments (3)

[Section 4.2, Protocol 1; Section 5; Section 2.3] The claimed server-side privacy guarantee is not established under the paper's threat model because the key distributor is trusted implicitly and is not part of the adversary model. Protocol 1 has the KD generate the FHE private key and send it to every client each round; consequently a malicious server can obtain the private key by colluding with any single client, and a malicious KD can decrypt every client update directly. Section 5 states 'complete protection against server-side inversion attacks' and '0-differential privacy', but these findings from [20,32] apply to a single-key setup without this KD trust anchor. The authors should either (a) add the KD as a trusted third party explicitly to the threat model and justify that assumption, (b) replace the KD with threshold decryption or distributed key generation so that no single entity holds the private key, or (c) weaken the privacy claims accordingly.
[Section 5] The theoretical argument for client-side security is not load-bearing as stated. The derivation E[S'] = (n/N) E[S] relies on the assumption that per-layer sensitivity random variables are i.i.d. with common mean mu, which is not justified and is questionable given heterogeneous layer sizes and roles; more importantly, this identity concerns the expected sum of layer sensitivities, not the success probability or fidelity of a gradient inversion attack. The paper's own experiments (Figures 11 and 13) show exponential rather than linear decay, so the linear derivation does not explain the observed security effect. In addition, the recommended operating point r <= 2/3 is extracted from the same GIA experiments that are used to validate the defense, making the threshold in-sample. Please either provide a formal relationship between sensitivity and attack success, test the i.i.d. assumption, or reposition the contribution as an empirical defense with a heuristic design rule.
[Section 6.6] The end-to-end poisoning claim is not directly tested. The GIA experiments assume that the adversary perfectly recovers a single client's gradient contribution for the target sample and then apply the Geiping et al. attack to a random subset of layers of that gradient, using an untrained ConvNet. They do not simulate the poisoning step of the actual protocol (malicious update construction, aggregation over p clients, global-model difference) or use gradients from models actually trained under BlindFL. This abstraction is useful as a worst-case probe, but it leaves a gap between the experimental result and the claim that 'BlindFL significantly impedes client-side model poisoning attacks'. An end-to-end evaluation with a trained BlindFL global model and the poisoning/isolation procedure of [40] would close that gap.

minor comments (5)

[Throughout] There are several typographical and formatting errors, including 'Generate-Reqest-Matrix' in Algorithm 1, 'PRIV ACY BY BLINDFL' in the Section 5 heading, and 'paramater'/'matricies' in Section 6.5 and Table 9; these should be corrected before publication.
[Section 6.4, Tables 4-7] The timing results are stated to measure only server-side aggregation time, while the abstract refers to 'space and time transmission costs per client'; please clarify whether the claimed savings include client-side encryption/decryption and network transfer, and align the wording with what is measured.
[Section 6, Tables 2-9] No code, data, or configuration files are provided, and the reported accuracies and timings do not include standard deviations or confidence intervals; adding these (or at least an anonymized repository) would substantially strengthen the efficiency and accuracy claims.
[Section 5] The phrase '0-differential privacy' is imprecise in this context: FHE provides computational hiding of ciphertexts, not a differential-privacy guarantee; if the term is retained, it should be formally defined or replaced with a cryptographic confidentiality statement.
[Section 6.3, Table 3] The accuracy results are non-monotonic in the fraction of shared parameter matrices (e.g., CIFAR at 40% is 73.06% versus 78.20% at 50%), so the claim of 'minimal adverse effect' would benefit from a statistical comparison or reported variance rather than point estimates alone.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the core efficiency, accuracy, and GIA-resistance claims are measured or derived from external results rather than from the paper's own conclusions.

full rationale

BlindFL's central claims are not circular. The CMS aggregation accuracy results are direct measurements against external benchmarks (MNIST/CIFAR-10) under standard FedAvg aggregation. The efficiency claims follow from the protocol's definition, since each client sends only a subset of parameter matrices, and they are confirmed by independent timing and bandwidth measurements. The client-to-client security argument combines an external sensitivity metric from Mo et al. [28] with a mathematical identity: under the stated iid assumption, E[S'] = (n/N) E[S] is linearity of expectation, not a fitted result, and the paper explicitly acknowledges that the experiments show a stronger exponential trend than this linear bound. The recommended threshold r <= 2/3 is a post-hoc design recommendation drawn from the same GIA experiments, not an independent prediction, so it does not make the empirical validation circular. The 0-DP server-side claim is imported from prior external work [20,32] and does not depend on the authors' own results. There are no load-bearing self-citations, no author-imported uniqueness theorems, and no ansatz smuggled in through citation. The main caveat is a threat-model gap rather than circularity: Protocol 1 relies on an honest key distributor, and the Section 2.3 threat model does not consider a malicious or colluding KD; this is a security-assumption concern that should be addressed, but it does not reduce any derivation to its inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

The ledger shows the central efficiency claim rests mainly on experimental parameters, while the client-to-client security claim rests on a weak sensitivity correlation plus a worst-case adversary assumption, and the server-side privacy claim rests on an unmodeled trusted key distributor.

free parameters (3)

p (matrices aggregated per global parameter matrix) = experiments use p = ceil(C/2) or values 2-10 of 10
User-configured aggregation redundancy; the accuracy and security results depend on p through the request matrix generator and the security experiments.
r = n/N (fraction of layers sent per client) = recommended r <= 2/3 in Section 6.6
The recommended operating point is derived from the same GIA experiments used to validate the security claim, so it is essentially fit to those measurements.
FHE context (n=2^14, scale=2^20, qi sizes [60,40,40,60]) = n=16384, scale=1048576, qi=[60,40,40,60]
Selected from Pan et al. tables for 128-bit security; these values determine the measured time and space costs.

assumptions (5)

domain assumption Single-key FHE-based FL achieves 0-differential privacy between client and server.
Invoked in Section 5, citing FedML-HE [20] and Phong et al. [32]; the paper does not re-derive it and it depends on the server never holding the private key.
domain assumption The sensitivity metric of Mo et al. [28] correlates with GIA success, so reducing expected sensitivity reduces inversion success.
Used in Section 5 to translate the linear expectation calculation into a claim about attack success; the correlation itself is not demonstrated in this paper.
ad hoc to paper Per-layer sensitivities are i.i.d. with mean mu, so E[sum] = N mu and E[subset] = n mu.
Stated in Section 5 as 'If we assume that each x_i is identically distributed with mean mu'; this is an idealization not justified by the model architectures used.
ad hoc to paper The key distributor is trusted and never colludes with the server.
Protocol 1 gives the KD the private key; no threat model covers a malicious KD, making the central server-side privacy claim conditional on this unstated trust.
domain assumption The adversary can exactly recover the target gradient contribution from the global model in the worst case.
Assumed in Section 6.6 to stress-test the defense; it is more powerful than current attacks, which favors the security conclusion but does not bound realistic adversaries.

invented entities (1)

Key Distributor (KD)
purpose: Generates CKKS key pairs each round, distributes the public key to clients, and releases the private key to clients only after server aggregation completes.
A new trusted node type introduced in Section 4.2; there is no external evidence or deployment analysis for it, and its compromise invalidates the server-side privacy claim.

how reviews work

0 comments

Cite this review

Pith. "Pith review of BlindFL: Segmented Federated Learning with Fully Homomorphic Encryption." pith.science (2026). https://pith.science/paper/NTEFQQKM

@misc{pith2026250111659,
  author       = {Pith},
  title        = {Pith review of: BlindFL: Segmented Federated Learning with Fully Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NTEFQQKM}},
  note         = {Machine review of arXiv:2501.11659}
}

read the original abstract

Federated learning (FL) is a popular privacy-preserving edge-to-cloud technique used for training and deploying artificial intelligence (AI) models on edge devices. FL aims to secure local client data while also collaboratively training a global model. Under standard FL, clients within the federation send model updates, derived from local data, to a central server for aggregation into a global model. However, extensive research has demonstrated that private data can be reliably reconstructed from these model updates using gradient inversion attacks (GIAs). To protect client data from server-side GIAs, previous FL schemes have employed fully homomorphic encryption (FHE) to secure model updates while still enabling popular aggregation methods. However, current FHE-based FL schemes either incur substantial computational overhead or trade security and/or model accuracy for efficiency. We introduce BlindFL, a framework for global model aggregation in which clients encrypt and send a subset of their local model update. With choice over the subset size, BlindFL offers flexible efficiency gains while preserving full encryption of aggregated updates. Moreover, we demonstrate that implementing BlindFL can substantially lower space and time transmission costs per client, compared with plain FL with FHE, while maintaining global model accuracy. BlindFL also offers additional depth of security. While current single-key, FHE-based FL schemes explicitly defend against server-side adversaries, they do not address the realistic threat of malicious clients within the federation. By contrast, we theoretically and experimentally demonstrate that BlindFL significantly impedes client-side model poisoning attacks, a first for single-key, FHE-based FL schemes.

Figures

Figures reproduced from arXiv: 2501.11659 by the authors.

**Figure 2.** Diagram displaying the security relationship be [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Full diagram of BlindFL. Protocol 1 Key Distributor Round Update Process 1: procedure Round Updates(scheme, 𝑛, scale, qi-size) 2: 𝐾𝑝𝑢𝑏, 𝐾𝑝𝑟𝑖𝑣 = FHE(scheme, 𝑛, scale, qi-size) 3: 𝑅 = Generate-Request-Matrix(𝑀, 𝑐, 𝑝) 4: for 𝑖 ← 1 to 𝑐 do 5: 𝑐𝑖 receives 𝐾𝑝𝑢𝑏 from KD 6: 𝑐𝑖 receives 𝑅𝑖 from server 7: for 𝑗 ← 1 to 𝑀 do 8: Enc(𝑤𝑖,𝑗) ← 𝐾𝑝𝑢𝑏 (𝑤𝑖,𝑗) 9: end for 10: 𝑐𝑖 sends Enc(𝑤𝑖), 𝑡𝑖 , 𝐾𝑝𝑢𝑏 to server 11: end for 12: KD sends… view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: Example of the impact of a GIA on a attacked gradi [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Accuracy averaged over 5 runs, varying client counts [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Accuracy averaged over 5 runs, varying client counts [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

**Figure 7.** Figure 7: Accuracy averaged over 5 runs for varying client [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

**Figure 8.** Figure 8: Accuracy averaged over 5 runs for varying client pa [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

**Figure 10.** Figure 10: Accuracy averaged over 5 runs over multiple [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]

**Figure 11.** Figure 11: Average PSNR and SSIM over 15 GIA reconstruc [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

**Figure 14.** Figure 14: The first 5 of the 15 averaged GIA reconstructions [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 20 canonical work pages

[28]

Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, and Soteris Demetriou. 2020. Layer-wise characterization of latent information leakage in federated learning. arXiv preprint arXiv:2010.08762 (2020)

work page Pith review arXiv 2020
[30]

Yao Pan, Zheng Chao, Wang He, Yang Jing, Li Hongjia, and Wang Liming. 2024. FedSHE: privacy preserving and efficient federated learning with adaptive seg- mented CKKS homomorphic encryption. Spring, Cybersecurity 7, 40 (2024). https://doi.org/doi.org/10.1186/s42400-024-00232-w

work page doi:10.1186/s42400-024-00232-w 2024
[40]

Jiaheng Wei, Yanjun Zhang, Leo Yu Zhang, Chao Chen, Shirui Pan, Kok-Leong Ong, Jun Zhang, and Yang Xiang. 2023. Client-side gradient inversion against federated learning from poisoning. (2023). arXivpreprintarXiv:2309.07415

arXiv 2023
[1]

Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdul- lahi Yari, and Björn Eskofier. 2022. Federated Learning for Healthcare: Systematic Review and Architecture Proposal. ACM Trans. Intell. Syst. Technol. 13, 4, Article 54 (may 2022), 23 pages. https://doi.org/10.1145/3501813

doi:10.1145/3501813 2022
[2]

Rezak Aziz, Soumya Banerjee, Samia Bouzefrane, and Thinh Le Vinh. 2023. Exploring Homomorphic Encryption and Differential Privacy Techniques to- wards Secure Federated Learning Paradigm. Future Internet 15, 9 (2023). https: //doi.org/10.3390/fi15090310

work page doi:10.3390/fi15090310 2023
[3]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In Advances in Neural Information Processing Systems , I. Guyon, U. Von Luxburg, 12 BlindFL: Segmented FL with FHE S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran ...

work page 2017
[4]

Mingqing Chen, Rajiv Mathews, Tom Ouyang, and Françoise Beaufays. 2019. Federated Learning Of Out-Of-Vocabulary Words. arXiv:1903.10635 [cs.CL]

arXiv 2019
[5]

Anda Cheng, Peisong Wang, Xi Sheryl Zhang, and Jian Cheng. 2022. Differen- tially Private Federated Learning with Local Regularization and Sparsification. arXiv:2203.03106 [cs.LG]

work page Pith review arXiv 2022

Show all 46 references

[6]

Jung Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homomorphic Encryption for Arithmetic of Approximate Numbers. 409–437. https://doi.org/ 10.1007/978-3-319-70694-8_15

2017 doi
[7]

Li Deng. 2012. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine 29, 6 (2012), 141–142

2012
[9]

Ezzeldin, Konstantinos Psounis, and Salman Avestimehr

Ahmed Roushdy Elkordy, Jiang Zhang, Yahya H. Ezzeldin, Konstantinos Psounis, and Salman Avestimehr. 2022. How Much Privacy Does Federated Learning with Secure Aggregation Guarantee? (2022). https://arxiv.org/abs/2208.02304

2022 arXiv
[10]

Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. 2020. Inverting Gradients – How easy is it to break privacy in federated learning? (2020). https://arxiv.org/abs/2003.14053

2020 arXiv
[11]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2015. Deep Residual Learning for Image Recognition. arXiv:1512.03385 [cs.CV] https://arxiv.org/abs/ 1512.03385

2015 arXiv
[12]

Zecheng He, Tianwei Zhang, and Ruby B. Lee. 2019. Model inversion at- tacks against collaborative inference. In Proceedings of the 35th Annual Com- puter Security Applications Conference (San Juan, Puerto Rico, USA) (ACSAC ’19). Association for Computing Machinery, New York, N...

2019
[13]

Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. 2017. Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (Dallas, Texas, USA) (CCS ’17). Associatio...

2017
[14]

Chenghao Hu, Jingyan Jiang, and Zhi Wang. 2019. Decentralized Federated Learning: A Segmented Gossip Approach. (2019). https://arxiv.org/abs/1908. 07782

2019
[15]

Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. 2021. Evaluating Gradient Inversion Attacks and Defenses in Federated Learning. (2021). https://arxiv.org/abs/2112.00059

2021 arXiv
[16]

Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. 2020. InstaHide: Instance- hiding Schemes for Private Distributed Learning. (2020). https://arxiv.org/abs/ 2010.02772

2020 arXiv
[17]

Alberto Ibarrando. 2023. Pyfhel Documentation. (2023). https: //pyfhel.readthedocs.io/en/latest/_autosummary/Pyfhel.Pyfhel.html#Pyfhel. Pyfhel.contextGen

2023
[18]

Alberto Ibarrondo. 2023. Pyfhel. https://github.com/ibarrond/Pyfhel

2023
[19]

Celestine Iwendi, Syed Atif Moqurrab, Adeel Anjum, Sangeen Khan, Senthilku- mar Mohan, and Gautam Srivastava. 2020. N-Sanitization: A semantic privacy- preserving framework for unstructured medical datasets. Computer Communi- cations 161 (2020), 160–171. https://doi.org/10.101...

2020 doi
[20]

Weizhao Jin, Yuhang Yao, Shanshan Han, Carlee Joe-Wong, Srivatsan Ravi, Salman Avestimehr, and Chaoyang He. 2023. FedML-HE: An Efficient Homomorphic-Encryption-Based Privacy-Preserving Federated Learning Sys- tem. arXiv:2303.10837 [cs.LG]

2023 arXiv
[21]

Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images . Technical Report

2009
[22]

Flower Labs. 2023. Flower. (2023). https://github.com/adap/flower

2023
[23]

Lecun, L

Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. 1998. Gradient-based learning applied to document recognition. Proc. IEEE 86, 11 (1998), 2278–2324. https: //doi.org/10.1109/5.726791

1998 doi
[24]

Renyang Liu, Wei Zhou, Jinhong Zhang, Xiaoyuan Liu, Peiyuan Si, and Haoran Li. 2023. Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks. (2023). arXiv:2310.09800 [cs.LG] https://arxiv.org/abs/2310. 09800

2023 arXiv
[25]

Lingjuan Lyu, Han Yu, and Qiang Yang. 2020. Threats to Federated Learning: A Survey. (2020). https://arxiv.org/abs/2003.02133

2020 arXiv
[26]

Priyanka Mary Mammen. 2021. Federated Learning: Opportunities and Chal- lenges. arXiv:2101.05428 [cs.LG]

2021 arXiv
[27]

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas

H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. 2023. Communication-Efficient Learning of Deep Net- works from Decentralized Data. arXiv:1602.05629 [cs.LG]

2023 arXiv
[29]

Mohammad Moshawrab, Mehdi Adda, Abdenour Bouzouane, Hussein Ibrahim, and Ali Raad. 2023. Reviewing Federated Learning Aggregation Algorithms; Strategies, Contributions, Limitations and Future Perspectives. Electronics 12, 10 (2023). https://doi.org/10.3390/electronics12102287

2023 doi
[31]

Jaehyoung Park and Hyuk Lim. 2022. Privacy-Preserving Federated Learning Using Homomorphic Encryption. Applied Sciences 12, 2 (2022). https://doi.org/ 10.3390/app12020734

2022 doi
[32]

Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Mo- riai. 2018. Privacy-Preserving Deep Learning via Additively Homomorphic Encryption. IEEE Transactions on Information Forensics and Security 13, 5 (2018), 1333–1345. https://doi.org/10.1109/TIFS.2017.2787987

2018
[33]

Yogachandran Rahulamathavan, Charuka Herath, Xiaolan Liu, Sangarapillai Lambotharan, and Carsten Maple. 2023. FheFL: Fully Homomorphic Encryption Friendly Privacy-Preserving Federated Learning with Byzantine Users. (2023). https://arxiv.org/abs/2306.05112

2023 arXiv
[34]

Théo Ryffel, Andrew Trask, Morten Dahl, Bobby Wagner, Jason Mancuso, Daniel Rueckert, and Jonathan Passerat-Palmbach. 2018. A generic framework for privacy preserving deep learning. CoRR abs/1811.04017 (2018). arXiv:1811.04017 http://arxiv.org/abs/1811.04017

2018 arXiv
[35]

Microsoft SEAL (release 3.5)

SEAL 2020. Microsoft SEAL (release 3.5). https://github.com/Microsoft/SEAL. Microsoft Research, Redmond, WA

2020
[36]

Yichuan Shi, Olivera Kotevska, Viktor Reshniak, Abhishek Singh, and Ramesh Raskar. 2024. Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomy. arXiv preprint arXiv:2405.10376 (2024)

2024 arXiv
[37]

Arnaud Grivet Sébert, Renaud Sirdey, Oana Stan, and Cédric Gouy-Pailler. 2022. Protecting Data from all Parties: Combining FHE and DP in Federated Learning. (2022). https://arxiv.org/abs/2205.04330

2022 arXiv
[38]

Yanbo Wang, Jian Liang, and Ran He. 2024. Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks. (2024). https://arxiv.org/abs/2402. 03124

2024
[39]

Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing 13, 4 (2004), 600–612

2004
[41]

Qipeng Xie, Siyang Jiang, Linshan Jiang, Yongzhi Huang, Zhihe Zhao, Salabat Khan, Wangchen Dai, Zhe Liu, and Kaishun Wu. 2024. Efficiency Optimiza- tion Techniques in Privacy-Preserving Federated Learning With Homomorphic Encryption: A Brief Survey. IEEE Internet of Things Jou...

2024
[43]

Xuefei Yin, Yanming Zhu, and Jiankun Hu. 2021. A Comprehensive Survey of Privacy-preserving Federated Learning: A Taxonomy, Review, and Future Directions. ACM Comput. Surv. 54, 6, Article 131 (jul 2021), 36 pages. https: //doi.org/10.1145/3460427

2021 doi
[44]

Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020. BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning. In 2020 USENIX annual technical conference (USENIX ATC 20) . 493–506

2020
[45]

Hongyi Zhang, Jan Bosch, and Helena Holmström Olsson. 2021. End-to-End Federated Learning for Autonomous Driving Vehicles. In2021 International Joint Conference on Neural Networks (IJCNN). 1–8. https://doi.org/10.1109/IJCNN52387. 2021.9533808

2021
[46]

Dauphin, and David Lopez-Paz

Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. 2017. mixup: Beyond Empirical Risk Minimization. (2017). https://arxiv.org/abs/1710. 09412

2017
[47]

Rui Zhang, Song Guo, Junxiao Wang, Xin Xie, and Dacheng Tao. 2022. A Survey on Gradient Inversion: Attacks, Defenses and Future Directions. arXiv:2206.07284 [cs.LG]

2022 arXiv
[48]

Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep Leakage from Gradients. (2019). https://arxiv.org/abs/1906.08935 13

2019 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [28]

Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, and Soteris Demetriou. 2020. Layer-wise characterization of latent information leakage in federated learning. arXiv preprint arXiv:2010.08762 (2020)

work page Pith review arXiv 2020

[2] [30]

Yao Pan, Zheng Chao, Wang He, Yang Jing, Li Hongjia, and Wang Liming. 2024. FedSHE: privacy preserving and efficient federated learning with adaptive seg- mented CKKS homomorphic encryption. Spring, Cybersecurity 7, 40 (2024). https://doi.org/doi.org/10.1186/s42400-024-00232-w

work page doi:10.1186/s42400-024-00232-w 2024

[3] [40]

Jiaheng Wei, Yanjun Zhang, Leo Yu Zhang, Chao Chen, Shirui Pan, Kok-Leong Ong, Jun Zhang, and Yang Xiang. 2023. Client-side gradient inversion against federated learning from poisoning. (2023). arXivpreprintarXiv:2309.07415

arXiv 2023

[4] [1]

Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdul- lahi Yari, and Björn Eskofier. 2022. Federated Learning for Healthcare: Systematic Review and Architecture Proposal. ACM Trans. Intell. Syst. Technol. 13, 4, Article 54 (may 2022), 23 pages. https://doi.org/10.1145/3501813

doi:10.1145/3501813 2022

[5] [2]

Rezak Aziz, Soumya Banerjee, Samia Bouzefrane, and Thinh Le Vinh. 2023. Exploring Homomorphic Encryption and Differential Privacy Techniques to- wards Secure Federated Learning Paradigm. Future Internet 15, 9 (2023). https: //doi.org/10.3390/fi15090310

work page doi:10.3390/fi15090310 2023

[6] [3]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In Advances in Neural Information Processing Systems , I. Guyon, U. Von Luxburg, 12 BlindFL: Segmented FL with FHE S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran ...

work page 2017

[7] [4]

Mingqing Chen, Rajiv Mathews, Tom Ouyang, and Françoise Beaufays. 2019. Federated Learning Of Out-Of-Vocabulary Words. arXiv:1903.10635 [cs.CL]

arXiv 2019

[8] [5]

Anda Cheng, Peisong Wang, Xi Sheryl Zhang, and Jian Cheng. 2022. Differen- tially Private Federated Learning with Local Regularization and Sparsification. arXiv:2203.03106 [cs.LG]

work page Pith review arXiv 2022