Pith. sign in

REVIEW 4 major objections 7 minor 59 references

Efficient Privacy-Preserving Cross-Silo Federated Learning with Multi-Key Homomorphic Encryption

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MASER makes multi-key homomorphic encryption practical for cross-silo federated learning by pruning model updates to a consensus-chosen 10% before encryption, cutting overhead 3.03 to 8.29 times while keeping accuracy on par with vanilla…

desk verdict Solid efficiency paper with a real trust-model gap: the 3-8x speedup is credible, but the privacy guarantee depends on a trusted key manager that the threat model never mentions. read the letter →

arxiv 2505.14797 v1 pith:MCYMJS5I submitted 2025-05-20 cs.CR

Abdullah Al Omar , Xin Yang , Euijin Choo , Omid Ardakanian This is my paper · ORCID
classification cs.CR
keywords multi-keyhomomorphicencryptionfederatedlearningmodelpruningconsensusmaskcross-siloaggregationprivacy-preservingmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes MASER, a privacy-preserving federated learning framework that makes multi-key homomorphic encryption affordable by encrypting only a small, consensus-selected slice of each model update. In MASER every client still holds its own encryption key, so the server aggregates ciphertexts and no single client can decrypt another's update. Before encryption, clients prune their local models by weight magnitude and vote through the server on a shared global mask, so all clients sparsify the same positions and aggregation remains meaningful. The authors report that with only 10% of weights retained, MASER runs 3.03 to 8.29 times faster than a standard MKHE-based FL baseline and 1.48 to 5 times slower than unencrypted FL, while keeping accuracy nearly identical to vanilla federated averaging. The main caveat is that the scheme relies on a trusted key manager to sum the clients' public keys.

What carries the argument

The load-bearing mechanism is consensus-based sparsification plus slot-based slicing. Magnitude-based pruning produces a binary local mask per client; the server fuses these by majority voting into a global mask that all clients apply, which keeps the sparse updates aligned so homomorphic addition yields a meaningful aggregate. The surviving parameters are reshaped into slices that exactly fill the n/2 plaintext slots of the CKKS/MKCKKS ciphertext space, minimizing the number of encryptions and the size of transmitted ciphertexts. Clients encrypt under an aggregated public key and later perform partial decryption with their own secret keys, so the server only ever sees ciphertexts.

What would settle it

Run MASER with a malicious key manager that replaces the aggregated public key with one whose secret key it knows, then try to decrypt a captured encrypted slice from a client; if the plaintext model update is recovered, the privacy guarantee collapses without the trust assumption.

Watch

Extended reading notes

Core claim

MASER's central claim is that sparsifying before encryption, guided by a per-round majority-voted mask, is what makes multi-key homomorphic encryption practical for cross-silo federated learning. Experiments on MNIST and CIFAR-10 in both IID and non-IID settings show that retaining only the top 10% of weights by magnitude keeps test accuracy within 0.2 percentage points of unencrypted FedAvg on MNIST and slightly exceeds vanilla FL on CIFAR-10, while cutting total runtime by 3.03x to 8.29x relative to encrypting the full model with MKHE. The paper argues that encrypting every parameter is unnecessary because a small set of large-magnitude weights carries almost all the information, provided all clients agree on which parameters to keep.

Load-bearing premise

The whole privacy story depends on a key manager who honestly aggregates clients' public keys and never abuses that position, yet the threat model never makes the key manager an adversary.

Editorial extensions

If this is right

  • The reported 1.48x to 1.58x runtime over unencrypted FL means a multi-key HE privacy layer moves from research prototype to a deployable option for cross-silo settings.
  • A 10% pruning threshold sits near the efficiency-accuracy sweet spot: keeping 90% of weights barely changes accuracy but can inflate encrypted traffic by an order of magnitude (e.g., 62.85 MB to 633.92 MB for CIFAR-10 slices).
  • Because MASER only assumes arithmetic aggregation, it can carry FedAvg, FedProx, and any aggregation rule expressible as additions, so existing FL pipelines can be wrapped in the protocol without changing the optimizer.
  • The per-round majority-vote mask also supplies robustness against malicious clients: experiments with 20% and 40% non-majority malicious clients show negligible accuracy degradation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The privacy guarantee is conditional on the trusted key manager: if that party is malicious or compromised, it can replace the aggregated public key and read all client updates, something the paper's threat model never considers.
  • Because the measured cost is dominated by ciphertext transmission and encryption, the same consensus-prune-then-slice recipe should transfer to other homomorphic backends or to secure aggregation, with gains growing as models get larger and sparser.
  • The small accuracy gain over vanilla FL on CIFAR-10 suggests the majority-vote mask acts as a regularizer; a testable extension is whether the consensus mask also dampens client drift under stronger non-IID skew.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes MASER, a multi-key homomorphic encryption (MKHE) based framework for cross-silo federated learning. To reduce the overhead of MKHE, clients prune their locally trained models with magnitude-based pruning at a per-round threshold κ, send binary masks to the server, and the server produces a global mask by majority voting; clients retain only the masked (important) parameters, slice them to the CKKS slot count, encrypt them under an aggregated public key pk, and the server aggregates homomorphically. Partial decryption by clients and merging at the server yield the plaintext aggregated model, which is then reconstructed in its original shape by the server. Experiments on MNIST and CIFAR-10 with 5 clients under IID and non-IID splits compare MASER against vanilla FedAvg/FedProx, FedPHE, BatchCrypt, MaskCrypt, FRL, a GraSP-based masking baseline, and an unpruned MKHE baseline. The paper reports accuracy comparable to or better than vanilla FL (e.g., 75.63% vs 74.27% on CIFAR-10 IID) at 10% retention, a 3.03-8.29x reduction in overhead relative to the MKHE baseline, and robustness to mask-poisoning by 20-40% malicious clients.

Significance. If the claims hold, MASER is a useful engineering contribution: reducing the practical cost of MKHE-based FL to 1.48-5x the runtime of vanilla FL (versus 4.7-39x for the unpruned MKHE variant) is an order-of-magnitude improvement in the deployability of multi-key HE for FL. The paper ships a real end-to-end implementation (Golang MKCKKS wrapped via cgo and imported into Python Flower/PyTorch), reports overhead measurements over 5 runs with standard deviations, includes a robustness experiment under 20% and 40% malicious clients, and includes a GraSP ablation that supports the claim that per-round re-pruning matters. The consensus-based mask and slicing design is simple and plausible. However, the two central claims—strong privacy guarantees and 3.03-8.29x efficiency over existing MKHE-based FL approaches—are currently stronger than what the manuscript supports: the privacy claim depends on a trusted key manager that is absent from the threat model, and the efficiency ratio is measured against a self-constructed ablation rather than an existing MKHE-FL system. These gaps are addressable within the scope of a revision.

major comments (4)
  1. [Sec. 4.2, Algorithm 1 lines 1-3, Sec. 3] The key manager is load-bearing for the privacy claim but is never placed in the adversary set. Section 3 defines the adversary as an honest-but-curious server and non-majority malicious clients; Section 4.2 then introduces a trusted key manager who aggregates the public keys, and in the implementation (Section 5.3) the key manager runs on the same machine as the server. A key manager that substitutes its own key pair for the aggregated pk (Algorithm 1, line 3) can decrypt every client's slice ciphertext directly, and because no verification of the aggregated key is specified, the abstract's strong privacy guarantees hold only under an unstated trust assumption. The stress-test concern is confirmed by the manuscript text: the revision should either add the key manager (including its co-location with the server) to the threat model with an explicit honest-and-non-colluding assumption, or provide a verifiable or distributed key-aggregation mechanism and a separate deployment, since the current text conflates the protocol's claimed guarantee with the experimental configuration.
  2. [Sec. 5.6, Figure 6] The privacy evaluation does not exercise the claimed adversary. The Geiping et al. reconstruction attack is defined against plaintext gradients or model updates, yet for MASER the attack is run on ciphertexts (Figure 6 caption), so near-zero ASR is obtained by construction and carries no evidential weight for the protocol's privacy; the actual guarantee is semantic security of MKCKKS under RLWE. The manuscript should either reframe this experiment as a sanity check and argue privacy from the cryptographic assumptions, or evaluate the relevant adversaries (e.g., an honest-but-curious server that sees the decrypted aggregated model, the per-client masks, and all ciphertexts; or a malicious client holding partial-decryption outputs), and should analyze what the plaintext masks reveal about client data.
  3. [Sec. 5.4, Figures 2 and 3] The accuracy comparison lacks statistical support. Section 5.5 reports 5 runs, but Figures 2 and 3 show single accuracy curves with no error bars or seed variance; the headline result that MASER-10% outperforms vanilla FL by about 1.3-1.4 points on CIFAR-10 (75.63 vs 74.27 IID; 76.64 vs 75.32 non-IID) is surprising for a model that discards 90% of the weights and is not explained in the text, since possible regularization or optimization artifacts are not discussed. Add error bars or a seed table and either provide an explanation for the improvement or soften the claim from surpassing to comparable.
  4. [Abstract, Sec. 5.2, Sec. 5.5] The headline 3.03 to 8.29 times more efficient than existing MKHE-based FL approaches overstates what is measured. The comparison baseline MKHE-based FL is constructed by the authors as MASER without sparsification (Section 5.2), i.e., an ablation, not an existing approach; no actual MKHE-FL system (e.g., SecFed [14], xMKCKKS [15], DHSA [57]) is benchmarked, so the ratio is partly by construction. The efficiency improvement over the ablation is a legitimate result, but the abstract and conclusion should attribute it as relative to a non-sparsified MKHE baseline, and ideally include at least one external MKHE-FL implementation or reported-cost comparison to support the existing approaches phrasing.
minor comments (7)
  1. [Algorithm 1, line 3] The assignment pk_i ← pk is confusing; it should read something like each client sets pk to the received aggregated public key.
  2. [Sec. 5.5] The phrase By pruning only 10% of the model weights, MASER-90% slightly reduces the total run time is confusing about what MASER-90% means; rephrase as pruning 10% of weights and retaining 90%.
  3. [Figure 6] The caption and the (ASR, PSNR) tuples do not clearly associate each numeric pair with the reconstructed image it belongs to; please relabel the figure panels.
  4. [Sec. 5.3] The statement that code will be publicly released upon acceptance should be replaced by an artifact link or a detailed reproducibility appendix in the revision, since the MKCKKS integration via cgo and the array substitution for the Go map are nontrivial and not independently verifiable as described.
  5. [Appendix A] The sensitivity to the pruning threshold κ is reported only for MNIST; since the CIFAR-10 overhead depends heavily on the slice count, add threshold-sensitivity results for CIFAR-10 as well.
  6. [Sec. 2.2] The notation is loose in places: the encryption description says d0 and d1 are used to sample the weight parameters in the ring R2q, and the level-l ciphertext definition introduces k without defining it; please clean up the definitions.
  7. [Sec. 4.2 and Sec. 3] The paper never analyzes what the per-client plaintext masks reveal about client data, even though the server sees every local mask every round; add at least a brief leakage analysis for the masks.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the claims are empirical measurements against external and ablative baselines, with no self-citation chain or definitional reduction of a prediction to its inputs.

full rationale

The paper's central claims are empirical, not derived: accuracy is benchmarked against vanilla FedAvg/FedProx and several external baselines (FRL, FedPHE, BatchCrypt, MaskCrypt, MAIN-GraSP), and overhead is measured end-to-end on two physical machines. The efficiency gain over the 'MKHE-based FL' baseline is not an analytical derivation: that baseline is defined as the same pipeline without sparsification (Section 5.2), and the reported speedups (3.03x, 7.80x, 8.29x, and the 1.48x-5x ratios over vanilla FL) are measured running times and serialized byte sizes, not quantities forced by an equation the paper itself defines. The observation that pruning to 10% of weights reduces the number of slices and ciphertexts is the intended mechanism, and the measured factors include mask exchange, slicing, encryption, partial decryption, aggregation, and network latency. No parameter is fitted to a subset of data and then reported as a prediction of a closely related quantity; no result is defined in terms of its own output; and no load-bearing argument reduces to a self-citation. The privacy guarantee rests on standard MKCKKS/xMKCKKS properties adopted from external work (refs [15], [25], [46]) and on an explicit threat model. The trusted-key-manager assumption is a genuine security-model limitation—the key manager is outside the stated adversary set and is co-located with the server in the implementation—but it is a trust-model gap, not a circular derivation of the claimed privacy guarantees.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central efficiency claim rests on empirical measurements with hand-chosen hyperparameters (κ, μ, n), while the privacy claim rests on standard RLWE hardness plus unstated trust in the key manager and unchecked plaintext mask leakage.

free parameters (3)
  • Pruning threshold κ = 10% top-magnitude weights
    Headline accuracy and overhead results (MASER-10%) are reported for this threshold; the paper shows in Appendix A that accuracy is fairly insensitive to threshold, but the 3.03-8.29x overhead reduction is tied to 10%.
  • FedProx proximal coefficient μ = 1.0
    Chosen for non-IID training; no sensitivity analysis reported in the paper.
  • MKHE polynomial modulus degree n = 8192
    Sets slot count λ=n/2=4096, defining slice size and ciphertext overhead; chosen as a security/efficiency tradeoff without a precise security level statement.
assumptions (5)
  • standard math RLWE hardness assumption
    Invoked in Definition 1 (RLWE) to justify the security of MKCKKS/xMKCKKS.
  • domain assumption Semantic security and correctness of the MKCKKS/xMKCKKS implementation used
    Sections 2.2 and 5.3 rely on the Golang MKCKKS implementation and the xMKCKKS public key aggregation being correct and secure as claimed by those references.
  • ad hoc to paper Trusted key manager is honest and non-colluding
    Algorithm 1 lines 1-3 and Section 4.2 require a key manager to aggregate public keys; the threat model (Section 3) does not include the key manager as an adversary or provide a verification mechanism.
  • domain assumption Fewer than 50% of clients are malicious
    Stated in the threat model footnote: majority voting requires that colluding malicious clients do not form a majority.
  • domain assumption Magnitude-based pruning preserves task-relevant information under consensus masks
    Section 4.2 and 5.4 assume that the top-κ% weights per client, intersected by majority vote, retain enough information for aggregation to converge to vanilla-level accuracy; this is validated only empirically on two datasets.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Privacy-Preserving Cross-Silo Federated Learning with Multi-Key Homomorphic Encryption." pith.science (2026). https://pith.science/paper/MCYMJS5I

@misc{pith2026250514797,
  author       = {Pith},
  title        = {Pith review of: Efficient Privacy-Preserving Cross-Silo Federated Learning with Multi-Key Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MCYMJS5I}},
  note         = {Machine review of arXiv:2505.14797}
}
read the original abstract

Federated Learning (FL) is susceptible to privacy attacks, such as data reconstruction attacks, in which a semi-honest server or a malicious client infers information about other clients' datasets from their model updates or gradients. To enhance the privacy of FL, recent studies combined Multi-Key Homomorphic Encryption (MKHE) and FL, making it possible to aggregate the encrypted model updates using different keys without having to decrypt them. Despite the privacy guarantees of MKHE, existing approaches are not well-suited for real-world deployment due to their high computation and communication overhead. We propose MASER, an efficient MKHE-based Privacy-Preserving FL framework that combines consensus-based model pruning and slicing techniques to reduce this overhead. Our experimental results show that MASER is 3.03 to 8.29 times more efficient than existing MKHE-based FL approaches in terms of computation and communication overhead while maintaining comparable classification accuracy to standard FL algorithms. Compared to a vanilla FL algorithm, the overhead of MASER is only 1.48 to 5 times higher, striking a good balance between privacy, accuracy, and efficiency in both IID and non-IID settings.

Figures

Figures reproduced from arXiv: 2505.14797 by the authors.

Figure 1
Figure 1. An illustration of MASER components and data flow between them We begin with an overview of MASER in Section 4.1. Next, we describe our model training and sparsification technique that reduces the overhead of MKHE-based FL in Section 4.2. In Section 4.3, we introduce the parameter slicing technique for efficient homomorphic encryption and model aggregation. Finally, we describe the decryption and model reconstructio… view at source ↗
Figure 2
Figure 2. Test accuracy across 25 FL rounds on MNIST their local model for e = 5 local epochs on their local datasets. We set the modulus degree λ for our MKHE algorithm to 8192 and the learning rate of the machine learning models to 0.01. For non-IID data distribution, we set the parameter µ used in FedProx to 1.0. We deployed MASER on two machines that are phys￾ically separate, located in two datacenters on the same campus,… view at source ↗
Figure 5
Figure 5. Time overhead for 25 FL rounds on CIFAR-10 in IID and non-IID settings on MNIST and CIFAR-10, respectively. We break down the total running time into two parts: data transmission time (hatched) and execution time (solid). We can readily see the efficiency of MASER-10% relative to the MKHE-based FL baseline. We first look at the overhead analysis on the MNIST dataset in [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figures from the paper (3 more)
Figure 6
Figure 6. Figure 6: Original and reconstructed images via the data reconstruction attack on the FL model of MASER-10% is almost evenly divided by the data transmission time and execution time, suggesting that our model sparsification technique successfully minimizes both communication and…
Figure 7
Figure 7. Figure 7: Test accuracy on MNIST with malicious clients 6. Related Work Several privacy-preserving techniques have been inte￾grated with FL. In this section, we mainly focus on the body of work that uses homomorphic encryption to protect data privacy in FL, as this is directly r…
Figure 8
Figure 8. Figure 8: demonstrates the test accuracy of MASER across different pruning thresholds (i.e., different levels of sparsity) under both IID and Non-IID settings. Each curve corresponds to a different pruning level, where the per￾centage indicates the proportion of model weights re…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 39 canonical work pages

  1. [14]

    Secfed: A secure and efficient federated learning based on multi-key homo- morphic encryption,

    Y . Cai, W. Ding, Y . Xiao, Z. Yan, X. Liu, and Z. Wan, “Secfed: A secure and efficient federated learning based on multi-key homo- morphic encryption,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 04, pp. 3817–3833, jul 2024

    work page 2024

  2. [15]

    Privacy-preserving federated learning based on multi-key homomorphic encryption,

    J. Ma, S.-A. Naas, S. Sigg, and X. Lyu, “Privacy-preserving federated learning based on multi-key homomorphic encryption,”International Journal of Intelligent Systems, vol. 37, no. 9, pp. 5880–5901, 2022

    2022

  3. [57]

    Dhsa: efficient doubly homomorphic secure aggregation for cross-silo federated learning,

    Z. Liu, S. Chen, J. Ye, J. Fan, H. Li, and X. Li, “Dhsa: efficient doubly homomorphic secure aggregation for cross-silo federated learning,” The Journal of Supercomputing, vol. 79, no. 3, pp. 2819–2849, 2023

    work page 2023

  4. [1]

    Advances and open problems in federated learning,

    P. Kairouzet al., “Advances and open problems in federated learning,” Foundations and trends in machine learning, vol. 14, no. 1–2, pp. 1– 210, 2021

    work page 2021

  5. [2]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,”Advances in neural information processing systems, vol. 32, 2019

    2019

  6. [3]

    See through gradients: Image batch recovery via grad- inversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via grad- inversion,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 16 337–16 346

    work page 2021

  7. [4]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems, vol. 33, pp. 16 937–16 947, 2020

    2020

  8. [5]

    Federated learning with differential privacy: Algo- rithms and performance analysis,

    K. Weiet al., “Federated learning with differential privacy: Algo- rithms and performance analysis,”IEEE Transactions on Information Forensics and Security, vol. 15, pp. 3454–3469, 2020

    work page 2020

Show all 59 references
  1. [6]

    Practical secure aggre- gation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggre- gation for privacy-preserving machine learning,” inproceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017...

    2017

  2. [7]

    Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning,” inProceedings of the 2020 USENIX Annual Technical Conference (USENIX ATC 2020), 2020

    2020

  3. [8]

    FedML-HE: An efficient homomorphic-encryption-based privacy-preserving federated learning system,

    W. Jin, Y . Yao, S. Han, C. Joe-Wong, S. Ravi, S. Avestimehr, and C. He, “FedML-HE: An efficient homomorphic-encryption-based privacy-preserving federated learning system,” inInternational Work- shop on Federated Learning in the Age of Foundation Models in Conjunction with Neu...

    2023

  4. [9]

    Differentially private learning needs bet- ter features (or much more data),

    F. Tramer and D. Boneh, “Differentially private learning needs bet- ter features (or much more data),” inInternational Conference on Learning Representations, 2021

    2021

  5. [10]

    Federated machine learning: Concept and applications,

    Q. Yang, Y . Liu, T. Chen, and Y . Tong, “Federated machine learning: Concept and applications,”ACM Transactions on Intelligent Systems and Technology (TIST), vol. 10, no. 2, pp. 1–19, 2019

    2019

  6. [11]

    On data banks and privacy homomorphisms,

    R. L. Rivest, L. Adleman, M. L. Dertouzoset al., “On data banks and privacy homomorphisms,”Foundations of secure computation, vol. 4, no. 11, pp. 169–180, 1978

    1978

  7. [12]

    Efficient and straggler-resistant homomorphic encryption for hetero- geneous federated learning,

    N. Yan, Y . Li, J. Chen, X. Wang, J. Hong, K. He, and W. Wang, “Efficient and straggler-resistant homomorphic encryption for hetero- geneous federated learning,” inProc. IEEE INFOCOM, 2024

    2024

  8. [13]

    Maskcrypt: Federated learning with selective homomorphic encryption,

    C. Hu and B. Li, “Maskcrypt: Federated learning with selective homomorphic encryption,”IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  9. [16]

    Privacy-preserving federated learning using homomorphic encryption with different encryption keys,

    J. Park, N. Y . Yu, and H. Lim, “Privacy-preserving federated learning using homomorphic encryption with different encryption keys,” in 2022 13th International Conference on Information and Communi- cation Technology Convergence (ICTC). IEEE, 2022, pp. 1869–1871. 14

    2022

  10. [17]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,”Proceedings of Machine learning and systems, vol. 2, pp. 429–450, 2020

    2020

  11. [18]

    Learning both weights and connections for efficient neural network,

    S. Han, J. Pool, J. Tran, and W. Dally, “Learning both weights and connections for efficient neural network,” inAdvances in Neural Information Processing Systems, vol. 28. Curran Associates, Inc., 2015

    2015

  12. [19]

    Every vote counts: Ranking-Based training of federated learning to resist poisoning attacks,

    H. Mozaffari, V . Shejwalkar, and A. Houmansadr, “Every vote counts: Ranking-Based training of federated learning to resist poisoning attacks,” in32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Aug. 2023, pp. 1721–1738

    2023

  13. [20]

    Cross-silo federated learning: Chal- lenges and opportunities,

    C. Huang, J. Huang, and X. Liu, “Cross-silo federated learning: Chal- lenges and opportunities,”arXiv preprint arXiv:2206.12949, 2022

    2022 arXiv

  14. [21]

    Backpropagation and stochastic gradient descent method,

    S.-i. Amari, “Backpropagation and stochastic gradient descent method,”Neurocomputing, vol. 5, no. 4-5, pp. 185–196, 1993

    1993

  15. [22]

    Communication-efficient learning of deep networks from decentral- ized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273–1282

    2017

  16. [23]

    Federated learning with non-iid data,

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra, “Federated learning with non-iid data,”arXiv preprint arXiv:1806.00582, 2018

    2018 arXiv

  17. [24]

    On ideal lattices and learning with errors over rings,

    V . Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,”Journal of the ACM (JACM), vol. 60, no. 6, pp. 1–35, 2013

    2013

  18. [25]

    Efficient multi-key ho- momorphic encryption with packed ciphertexts with application to oblivious neural network inference,

    H. Chen, W. Dai, M. Kim, and Y . Song, “Efficient multi-key ho- momorphic encryption with packed ciphertexts with application to oblivious neural network inference,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 395–412

    2019

  19. [26]

    Second order derivatives for network pruning: Optimal brain surgeon,

    B. Hassibi and D. Stork, “Second order derivatives for network pruning: Optimal brain surgeon,” inAdvances in Neural Information Processing Systems, vol. 5. Morgan-Kaufmann, 1992

    1992

  20. [27]

    Optimal brain damage,

    Y . LeCun, J. Denker, and S. Solla, “Optimal brain damage,” in Advances in Neural Information Processing Systems, vol. 2. Morgan- Kaufmann, 1989

    1989

  21. [28]

    Lookahead: A far- sighted alternative of magnitude-based pruning,

    S. Park, J. Lee, S. Mo, and J. Shin, “Lookahead: A far- sighted alternative of magnitude-based pruning,” inInternational Conference on Learning Representations, 2020. [Online]. Available: https://openreview.net/forum?id=ryl3ygHYDB

    2020

  22. [29]

    The state of sparsity in deep neural networks,

    T. Gale, E. Elsen, and S. Hooker, “The state of sparsity in deep neural networks,”arXiv e-prints, vol. arXiv:1902.09574, 2019. [Online]. Available: https://arxiv.org/abs/1902.09574

    1902 arXiv

  23. [30]

    Snip: Single-shot net- work pruning based on connection sensitivity,

    N. Lee, T. Ajanthan, and P. H. Torr, “Snip: Single-shot net- work pruning based on connection sensitivity,”arXiv preprint arXiv:1810.02340, 2018

    2018 arXiv

  24. [31]

    Picking winning tick- ets before training by preserving gradient flow,

    C. Wang, G. Zhang, and R. Grosse, “Picking winning tick- ets before training by preserving gradient flow,”arXiv preprint arXiv:2002.07376, 2020

    2002 arXiv

  25. [32]

    Pruning neural networks without any data by iteratively conserving synaptic flow,

    H. Tanaka, D. Kunin, D. L. Yamins, and S. Ganguli, “Pruning neural networks without any data by iteratively conserving synaptic flow,” Advances in neural information processing systems, vol. 33, pp. 6377–6389, 2020

    2020

  26. [33]

    A survey on deep neural network pruning: Taxonomy, comparison, analysis, and recommendations,

    H. Cheng, M. Zhang, and J. Q. Shi, “A survey on deep neural network pruning: Taxonomy, comparison, analysis, and recommendations,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    2024

  27. [34]

    Revisiting sparsity hunting in federated learning: Why does sparsity consensus matter?

    S. Babakniya, S. Kundu, S. Prakash, Y . Niu, and S. Avestimehr, “Revisiting sparsity hunting in federated learning: Why does sparsity consensus matter?”Transactions on Machine Learning Research, 2023

    2023

  28. [35]

    A masked pruning approach for di- mensionality reduction in communication-efficient federated learning systems,

    T. L. Gez and K. Cohen, “A masked pruning approach for di- mensionality reduction in communication-efficient federated learning systems,”arXiv preprint arXiv:2312.03889, 2023

    2023 arXiv

  29. [36]

    Privacy-preserving deep learning via additively homomorphic encryption,

    Y . Aono, T. Hayashi, L. Wang, S. Moriaiet al., “Privacy-preserving deep learning via additively homomorphic encryption,”IEEE Trans- actions on Information Forensics and Security, vol. 13, no. 5, pp. 1333–1345, 2017

    2017

  30. [37]

    Practical secure aggregation for privacy- preserving machine learning,

    K. Bonawitzet al., “Practical secure aggregation for privacy- preserving machine learning,” inProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’17. ACM, 2017, pp. 1175–1191

    2017

  31. [38]

    Scaffold: Stochastic controlled averaging for federated learning,

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learning,” inInternational conference on machine learning. PMLR, 2020, pp. 5132–5143

    2020

  32. [39]

    Tackling the objective inconsistency problem in heterogeneous federated optimiza- tion,

    J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V . Poor, “Tackling the objective inconsistency problem in heterogeneous federated optimiza- tion,”Advances in neural information processing systems, vol. 33, pp. 7611–7623, 2020

    2020

  33. [40]

    Measuring the effects of non- identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non- identical data distribution for federated visual classification,”arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

  34. [41]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  35. [42]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hintonet al., “Learning multiple layers of features from tiny images,” 2009

    2009

  36. [43]

    Supermasks in superposition,

    M. Wortsman, V . Ramanujan, R. Liu, A. Kembhavi, M. Rastegari, J. Yosinski, and A. Farhadi, “Supermasks in superposition,”Advances in Neural Information Processing Systems, vol. 33, pp. 15 173–15 184, 2020

    2020

  37. [44]

    What’s hidden in a randomly weighted neural net- work?

    V . Ramanujan, M. Wortsman, A. Kembhavi, A. Farhadi, and M. Rastegari, “What’s hidden in a randomly weighted neural net- work?” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 893–11 902

    2020

  38. [45]

    Flower: A friendly federated learning research framework,

    D. J. Beutel, T. Topal, A. Mathur, X. Qiu, J. Fernandez-Marques, Y . Gao, L. Sani, K. H. Li, T. Parcollet, P. P. B. de Gusm ˜aoet al., “Flower: A friendly federated learning research framework,”arXiv preprint arXiv:2007.14390, 2020

    2007 arXiv

  39. [46]

    Asymptotically faster multi-key homomorphic encryption from homomorphic gadget decomposition,

    T. Kim, H. Kwak, D. Lee, J. Seo, and Y . Song, “Asymptotically faster multi-key homomorphic encryption from homomorphic gadget decomposition,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 726–740

    2023

  40. [47]

    xmkckks implementation,

    “xmkckks implementation,” https://github.com/MetisPrometheus/MSc- thesis-xmkckks, 2024 [Online], accessed in 2024

    2024

  41. [48]

    iDLG: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “iDLG: Improved deep leakage from gradients,”arXiv preprint arXiv:2001.02610, 2020

    2001 arXiv

  42. [49]

    A framework for evaluating gradient leakage attacks in federated learning,

    W. Wei, L. Liu, M. Loper, K.-H. Chow, M. E. Gursoy, S. Truex, and Y . Wu, “A framework for evaluating gradient leakage attacks in federated learning,”arXiv preprint arXiv:2004.10397, 2020

    2004 arXiv

  43. [50]

    Fully homomorphic encryption using ideal lattices,

    C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 169–178

    2009

  44. [51]

    Fully homomorphic encryption with relatively small key and ciphertext sizes,

    N. P. Smart and F. Vercauteren, “Fully homomorphic encryption with relatively small key and ciphertext sizes,” inPublic Key Cryptography–PKC 2010: 13th International Conference on Practice and Theory in Public Key Cryptography, Paris, France, May 26-28,

    2010

  45. [52]

    Demystifying bootstrapping in fully homomorphic encryption,

    A. Al Badawi and Y . Polyakov, “Demystifying bootstrapping in fully homomorphic encryption,”Cryptology ePrint Archive, 2023

    2023

  46. [53]

    Homopai: A secure collaborative machine learning platform based on homomorphic encryption,

    Q. Li, Z. Huang, W.-j. Lu, C. Hong, H. Qu, H. He, and W. Zhang, “Homopai: A secure collaborative machine learning platform based on homomorphic encryption,” in2020 IEEE 36th International Con- ference on Data Engineering (ICDE). IEEE, 2020, pp. 1713–1717. 15

    2020

  47. [54]

    Copifl: A collusion-resistant and privacy-preserving federated learn- ing crowdsourcing scheme using blockchain and homomorphic en- cryption,

    R. Xiong, W. Ren, S. Zhao, J. He, Y . Ren, K.-K. R. Choo, and G. Min, “Copifl: A collusion-resistant and privacy-preserving federated learn- ing crowdsourcing scheme using blockchain and homomorphic en- cryption,”Future Generation Computer Systems, vol. 156, pp. 95– 104, 2024

    2024

  48. [55]

    Ho- momorphic encryption-based privacy-preserving federated learning in iot-enabled healthcare system,

    L. Zhang, J. Xu, P. Vijayakumar, P. K. Sharma, and U. Ghosh, “Ho- momorphic encryption-based privacy-preserving federated learning in iot-enabled healthcare system,”IEEE Transactions on Network Science and Engineering, vol. 10, no. 5, pp. 2864–2880, 2022

    2022

  49. [56]

    Secure aggregation in federated learning via multiparty homomorphic encryption,

    E. Hosseini and A. Khisti, “Secure aggregation in federated learning via multiparty homomorphic encryption,” in2021 IEEE Globecom Workshops (GC Wkshps). IEEE, 2021, pp. 1–6

    2021

  50. [58]

    Fedmask: Joint computation and communication-efficient personalized feder- ated learning via heterogeneous masking,

    A. Li, J. Sun, X. Zeng, M. Zhang, H. Li, and Y . Chen, “Fedmask: Joint computation and communication-efficient personalized feder- ated learning via heterogeneous masking,” inProceedings of the 19th ACM conference on embedded networked sensor systems, 2021, pp. 42–55. Appendix...

    2021

  51. [2010]

    Springer, 2010, pp

    Proceedings 13. Springer, 2010, pp. 420–443

    2010

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.