Pith. sign in

REVIEW 4 major objections 5 minor 33 references

VerifBFL: Leveraging zk-SNARKs for A Verifiable Blockchained Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Zero-knowledge proofs verify every federated learning step.

desk verdict A genuinely novel application of Nova IVC to federated learning, but both central proof constructions fail to bind the statements they claim to verify, so the advertised end-to-end verifiability is not delivered. read the letter →

arxiv 2501.04319 v1 pith:2FQXZCXG submitted 2025-01-08 cs.CR cs.DCcs.ETcs.LG

Ahmed Ayoub Bellachia , Mouhamed Amine Bouchiha , Yacine Ghamri-Doudane , Mourad Rabah This is my paper · ORCID
classification cs.CRcs.DCcs.ETcs.LG
keywords blockchainfederatedlearningzk-SNARKincrementallyverifiablecomputationNovadifferentialprivacycrowdsourcing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

VerifBFL is a proposed blockchain-based federated learning framework for crowdsourcing in which no participant is trusted by default. Its central claim is that recursive zk-SNARK proofs, built with the Nova folding scheme, let each trainer prove the accuracy of its local update and let each aggregator prove correct FedAvg aggregation, with the proofs checked in the blockchain layer through a decentralized oracle network. If this holds, a crowdsourced learning task can detect lazy trainers, replay attacks, and faulty aggregation without a central authority, while differential privacy noise protects local updates from inference attacks. The paper positions this as the first use of recursive zk-SNARKs for end-to-end verifiability of the federated learning workflow, and reports proof-of-concept timings of about 81 seconds for a training proof, about 2 seconds for an aggregation proof, and under 0.6 seconds for verification.

What carries the argument

The central object is Nova, a recursive zero-knowledge SNARK that implements incrementally verifiable computation: each step of a computation is folded into a running proof instance, so one compressed proof covers arbitrarily many steps. VerifBFL defines one inference of the model as the step function F for training proofs, with the IVC state z_i being the running count of correct predictions; at step n the predicate Acc = z_n/n is itself part of the attested computation. For aggregation, the step function is one FedAvg addition of a local model; the paper notes that in the implementation the IVC state only carries a correctness flag because the full model vector is too large to fold, so the aggregation proof attests to faithful execution of each addition circuit rather than to the summed vector directly. The compressed Nova SNARK is what makes verifying the entire chain constant-time for the verifier.

What would settle it

A single concrete experiment would settle the core claim: ask a trainer to submit a model known to be useless, such as one that always outputs the majority class, together with a proof of accuracy computed over a self-selected set of trivially classifiable inputs. If the system accepts the proof and pays the reward, then the claim that VerifBFL prevents free-riding and lazy training is refuted; if the task publisher instead supplies a fixed, signed test set and the proof still verifies, the claim is supported.

Watch

Extended reading notes

Core claim

The paper claims that end-to-end verifiability in blockchain-based federated learning can be achieved by expressing the two operations that matter—local training quality and global model aggregation—as incrementally verifiable computations and attesting to them with Nova recursive zk-SNARKs. For local training, the prover runs n inference operations, counts correct predictions in the IVC state z_i, and proves that the reported accuracy equals z_n/n. For aggregation, the prover folds each FedAvg addition step into a recursive proof, and the compressed SNARK makes the whole chain checkable in constant time. Because invalid or missing proofs cause loss of stake and blacklisting, the framework converts honest participation from a trust assumption into an economically enforced, publicly auditable obligation. The proof-of-concept reports training-proof generation around 81 seconds, aggregation-proof generation around 2 seconds, and verification under 0.6 seconds.

Load-bearing premise

The whole verifiability guarantee rests on treating the accuracy of a local model as the metric a trainer must prove, but the test dataset used for that accuracy is chosen by the trainer itself, so a lazy or malicious trainer can pass the proof by evaluating on easy, self-selected inputs.

Editorial extensions

If this is right

  • Local updates are auditable: a trainer must produce a proof tying the submitted model to a computed accuracy, and invalid submissions lead to forfeited stake and blacklisting.
  • Aggregation is auditable: the aggregator's proof ties the global model to FedAvg over the accepted local models, so skipping or faking aggregation is detectable.
  • On-chain overhead stays small: because Nova verification is constant-time in the number of training steps, the blockchain layer performs a cheap check per round.
  • Privacy and verifiability are combined: differential privacy noise is added to local updates before proof generation, while the zero-knowledge property prevents the proof itself from leaking training data.
  • The framework's security depends on at least two-thirds of blockchain and oracle nodes behaving honestly, so it avoids trusting FL participants but not the infrastructure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the accuracy proof is better read as a proof of a self-reported metric than a proof of learning: because the trainer selects the test inputs, a lazy trainer can satisfy the proof without improving the model; a direct fix would be publisher-signed test data or a circuit that proves gradient-descent updates.
  • Beyond the paper, the described aggregation proof keeps only a boolean flag in the IVC running state, so it attests to execution of addition steps rather than to the final sum; folding the model vector into the state would turn it into a full equality proof of the FedAvg result.
  • Beyond the paper, the 81-second training-proof time suggests the practical bottleneck is on the prover side; since verification is under a second, the framework scales to many trainers more easily than to very deep or large models.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. VerifBFL proposes a blockchain-based federated learning framework that uses zk-SNARKs (specifically Nova's incrementally verifiable computation) to generate proofs of local training accuracy and of global model aggregation, with proofs verified on-chain through a decentralized oracle network. The paper claims trustless verifiability of both local training and aggregation, privacy protection via differential privacy, and reports a proof-of-concept implementation with benchmarks for proof generation and blockchain throughput.

Significance. If the central claims were sound, VerifBFL would be a useful step toward accountable, trustless federated learning in crowdsourced settings. The paper also has tangible strengths: it implements a working prototype using the Nova crate, measures proof-generation and verification times, and evaluates on-chain performance with Hyperledger Caliper. However, the core cryptographic constructions, as described, do not prove the statements that the system claims to prove. The accuracy proof only attests to self-reported accuracy on a trainer-chosen test set, and the aggregation proof deliberately drops the FedAvg weights and carries a binary flag instead of the accumulated model sum. These issues are load-bearing and undermine the paper's central contribution.

major comments (4)
  1. [Section V.B] The IVC state z_i is described as being "set to 1 if invocation i is performed correctly" and explicitly "cannot hold the addition result of local models because of its high dimension." In Nova, a proof certifies a transcript z_{k+1}=F(z_k,w_k); if the carried state is only a binary flag, then F is not the weighted addition of model vectors, and the proof does not assert anything about the final global model w_glob. A malicious aggregator can run the step circuits honestly, obtain a valid proof, and submit an arbitrary w_glob, including a replay or a garbage model, because no constraint in the proof statement links the proof to the IPFS hash of the submitted global model.
  2. [Section V.B] The proof construction removes the FedAvg weight factors n_k/n "for the sake of simplicity." This means the step circuit F does not compute the weighted aggregation that the protocol's claimed statement w_glob ← Σ (n_k/n) w_k requires. At best, the proof attests to an unweighted sum of local model vectors, which is a different aggregation rule from the one defined in the FL protocol, so the proof does not establish the integrity of the FedAvg aggregation process.
  3. [Section V.A, Eq. (1)] The accuracy proof computes Acc = z_n/n, where z_n is the number of correct predictions on a test dataset {w_0,...,w_{n-1}} chosen by the trainer. This attests only to the model's performance on self-selected inputs; it does not attest to any property of the local training process. A lazy or malicious trainer can select an easy test set, or even report any desired accuracy, and then produce a valid proof that the reported accuracy matches the chosen test set. Consequently, the claimed "verifiability of local training" is not established by this construction.
  4. [Section VI] The security analysis claims that free-riding is prevented because the knowledge soundness of Nova ensures that "proofs cannot be forged unless the trainers have conducted the training with integrity." This is a non sequitur: the accuracy proof covers only a sequence of inference operations on trainer-selected inputs, not the training computation. Knowledge soundness of the zk-SNARK does not imply that any training was performed or that it followed the protocol. The analysis therefore does not support the paper's central guarantee that local training integrity is verifiable.
minor comments (5)
  1. [Section IV.B] The phrase "T the FL actors" appears to be a typo and should read "The FL actors."
  2. [Section IV.C] The subsection header "VerifBFL Arichitecture" contains a typo; it should be "Architecture."
  3. [Section V.B] The text says "aggregate n local models {w0,w1,...,wn}" which lists n+1 models; the indexing should be made consistent throughout the description.
  4. [Section V] The formal completeness and knowledge-soundness properties are stated for a generic relation R that is never instantiated for the accuracy or aggregation statements. The paper should specify what (u,w) and F are in each application; as written, the formal properties are vacuous.
  5. [Section VII] The performance evaluation is limited to a single dataset (MNIST) with 100 test images and five local models. The reported proof-generation time of about 81 seconds for training is for a small CNN, and the paper should discuss generalization to larger models and datasets.

Circularity Check

2 steps flagged · score 6.0 of 10

The accuracy proof is defined as the trainer's own test-set count (Eq. 1), and the aggregation proof's IVC state is only a correctness flag that cannot carry the addition result, so the advertised end-to-end verifiability reduces by construction to self-selected inputs and step-circuit execution.

  1. self definitional [Section V.A (Proof of Accuracy), Eq. (1), and the 'Proof of Accuracy' algorithm input list]
    "The trainers, upon local training, generate proofs to attest the accuracy of their trained model. The statement that a prover claims is that their local model M has a given accuracy Acc. ... In our construction zi represents a counter for the number of correct predictions accomplished in the set of invocations {0,1, ...,i − 1} of F. ... The accuracy of the model can be obtained as follows: Acc = number of correct predictions / number of total predictions = zn/n (1). Proof of Accuracy • Input: Test dataset {w0, ..,wn−1} and public parameters pp."

    The proof is constructed so that the statement being proven is exactly Acc = zn/n, where zn is the number of correct predictions on the test dataset w0..wn−1 supplied by the prover/trainer. No circuit constraint ties this statement to the training process, the training data distribution, or an independent test set. Therefore the paper's claim that these proofs verify 'the integrity of the generated model' reduces by construction to a self-reported accuracy on self-selected inputs; a lazy trainer can choose an easy test set and honestly prove the resulting Acc. The advertised 'verifiability of local training' guarantee is equivalent to verifying the prover's own definition of accuracy, not the integrity of training.

  2. self definitional [Section V.B (Proof of Aggregation), paragraph before the 'Proof of Aggregation' algorithm]
    "the prover claims the following statement: wglob ← Σk∈S nk/n wk ... For the sake of simplicity, we remove the weight factor nk/n ... Due to implementation specifications, in this setup, the running input to F: zi will be set to 1 if invocation i is performed correctly. zi cannot hold the addition result of local models because of its high dimension."

    The advertised statement is wglob = Σ(nk/n)wk, but the implemented IVC has zi as a Boolean flag and F does not carry the addition result. A Nova/IVC proof certifies a transcript z_{k+1}=F(zk,wk); with zi a flag it certifies only that each AggregationCircuit step ran, not that the submitted IPFS hash corresponds to the weighted sum of local models. Removing nk/n further decouples the proof from FedAvg. The generic completeness/soundness properties in Section V are stated for an unspecified relation R, so they cannot bind the proof to wglob. Consequently the 'proof of the integrity of the resulting global model' reduces by construction to a step-execution flag check, not to the claimed aggregation equation.

full rationale

VerifBFL's central claim is end-to-end verifiability of local training and aggregation. The accuracy proof (Section V.A) is not circular as a zk-SNARK: it honestly proves the relation R_train = {Acc = zn/n on the trainer-supplied test set}. But the paper's advertised guarantee—'verifiability of local training' and prevention of free-riding—identifies this self-reported, self-selected accuracy with training integrity. That identification is definitional, not derived. The aggregation proof (Section V.B) is worse: the paper explicitly states that zi is a Boolean flag and cannot carry the addition result, so the implemented IVC relation is not the claimed FedAvg statement wglob = Σ(nk/n)wk, and the proof is not bound to the submitted IPFS hash. Generic Nova completeness/soundness properties are quoted for an undefined relation R and cannot close this gap. No author self-citation chain is involved; Nova is external, independently published, and code-implemented, so it is real evidence. The circularity is in the framework's own construction: the 'derived' guarantees are built to be equivalent to the inputs (prover-chosen test examples; step-execution flags), not to the advertised statements. Hence score 6.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests entirely on cryptographic properties inherited from Nova and on two ad hoc modeling choices: that self-selected test accuracy constitutes training integrity, and that weight-free summation constitutes FedAvg. Both choices are made inside the proof construction without independent justification.

free parameters (3)
  • Differential privacy budget epsilon
    The framework relies on epsilon-DP noise to block inference attacks, but the paper never specifies or tunes epsilon; the security analysis assumes 'sufficiently low epsilon' without giving a concrete value or accuracy tradeoff.
  • Accuracy test set size n = 100 images
    Benchmark uses n=100 test images for the proof-of-accuracy; the reported 81s proving time and 0.642s verification time depend on this chosen circuit size.
  • Number of local models for aggregation proof = 5
    The aggregation proof benchmark combines five local models; the 2.189s proving time is specific to this small configuration and does not reflect cross-device FL scale.
assumptions (4)
  • standard math DLOG hardness assumption and random oracle heuristic for Nova zk-SNARK
    Invoked in Section V: 'These properties are obtained from the Nova proof construction under the discrete logarithm (DLOG) hardness assumption and provided that we heuristically instantiate the random oracle with a concrete hash function in the standard model.'
  • domain assumption At least 2/3 of blockchain nodes and 2/3 of DON nodes behave honestly
    Stated in Section IV.B Threat Model; the whole accountability argument depends on PBFT and DON fault tolerance.
  • ad hoc to paper Proof of accuracy on a trainer-selected test dataset is a valid attestation of local training integrity
    Section V.A builds the accuracy proof by counting correct predictions on the trainer's chosen test inputs; the paper never justifies why this prevents free-riding, since a lazy trainer can select an easy test set.
  • ad hoc to paper Removing the FedAvg weight factors n_k/n still constitutes a valid proof of FedAvg aggregation
    Section V.B explicitly drops the weight factor 'for the sake of simplicity', yet the claim is that the proof attests to FedAvg; this is not equivalent to the stated aggregation rule.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VerifBFL: Leveraging zk-SNARKs for A Verifiable Blockchained Federated Learning." pith.science (2026). https://pith.science/paper/2FQXZCXG

@misc{pith2026250104319,
  author       = {Pith},
  title        = {Pith review of: VerifBFL: Leveraging zk-SNARKs for A Verifiable Blockchained Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2FQXZCXG}},
  note         = {Machine review of arXiv:2501.04319}
}
read the original abstract

Blockchain-based Federated Learning (FL) is an emerging decentralized machine learning paradigm that enables model training without relying on a central server. Although some BFL frameworks are considered privacy-preserving, they are still vulnerable to various attacks, including inference and model poisoning. Additionally, most of these solutions employ strong trust assumptions among all participating entities or introduce incentive mechanisms to encourage collaboration, making them susceptible to multiple security flaws. This work presents VerifBFL, a trustless, privacy-preserving, and verifiable federated learning framework that integrates blockchain technology and cryptographic protocols. By employing zero-knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs) and incrementally verifiable computation (IVC), VerifBFL ensures the verifiability of both local training and aggregation processes. The proofs of training and aggregation are verified on-chain, guaranteeing the integrity and auditability of each participant's contributions. To protect training data from inference attacks, VerifBFL leverages differential privacy. Finally, to demonstrate the efficiency of the proposed protocols, we built a proof of concept using emerging tools. The results show that generating proofs for local training and aggregation in VerifBFL takes less than 81s and 2s, respectively, while verifying them on-chain takes less than 0.6s.

Figures

Figures reproduced from arXiv: 2501.04319 by the authors.

Figure 1
Figure 1. Design Overview: VerifBFL is composed of two layers, with [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Chainlink Request Model: the consumer contract sends [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Latency and Throughput of VerifBFL Consensus PBFT Number of nodes 4 Blockperiodseconds 1 Timestamp 0x58ee40ba GasLimit 0x1fffffffffffff Epochlength 30000 TABLE II: Blockchain Configuration 2) Performance Evaluation: To assess the performance of our system, we consider two metrics for our evaluation: • Throughput. is expressed by the number of successful transactions per time unit. • Latency. refers to the elapsed ti… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 23 canonical work pages

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  2. [2]

    Poisoning attacks against federated learning in load forecasting of smart energy,

    N. B. S. Qureshi, D.-H. Kim, J. Lee, and E.-K. Lee, “Poisoning attacks against federated learning in load forecasting of smart energy,” in NOMS IEEE/IFIP Network Operations and Management Symposium . IEEE, 2022, pp. 1–7

    work page 2022

  3. [3]

    A survey on security and privacy of federated learning,

    V . Mothukuri, R. M. Parizi, S. Pouriyeh, Y . Huang, A. Dehghantanha, and G. Srivastava, “A survey on security and privacy of federated learning,” Future Generation Computer Systems, vol. 115, pp. 619–640, 2021

    work page 2021

  4. [4]

    Threats to federated learning,

    L. Lyu, H. Yu, J. Zhao, and Q. Yang, “Threats to federated learning,” Federated Learning: Privacy and Incentive , pp. 3–16, 2020

    work page 2020

  5. [5]

    Blockchained on-device federated learning,

    H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Blockchained on-device federated learning,” IEEE Communications Letters , vol. 24, no. 6, pp. 1279–1283, 2019

    work page 2019

  6. [6]

    Federated learning meets blockchain in edge computing: Opportunities and challenges,

    D. C. Nguyen, M. Ding, Q.-V . Pham, P. N. Pathirana, L. B. Le, A. Seneviratne, J. Li, D. Niyato, and H. V . Poor, “Federated learning meets blockchain in edge computing: Opportunities and challenges,” IEEE Internet of Things Journal , vol. 8, no. 16, pp. 12 806–12 825, 2021

    2021

  7. [7]

    Flchain: A blockchain for auditable federated learning with trust and incentive,

    X. Bao, C. Su, Y . Xiong, W. Huang, and Y . Hu, “Flchain: A blockchain for auditable federated learning with trust and incentive,” in 2019 5th International Conference on Big Data Computing and Communications (BIGCOM), 2019, pp. 151–159

    work page 2019

  8. [8]

    V oyager: Mtd-based aggregation protocol for mitigating poisoning attacks on dfl,

    C. Feng, A. H. Celdr ´an, M. Vuong, G. Bovet, and B. Stiller, “V oyager: Mtd-based aggregation protocol for mitigating poisoning attacks on dfl,” in NOMS IEEE Network Operations and Management Symposium . IEEE, 2024, pp. 1–9

    work page 2024

Show all 33 references
  1. [9]

    Differential privacy,

    C. Dwork, “Differential privacy,” in International colloquium on au- tomata, languages, and programming . Springer, 2006, pp. 1–12

    2006

  2. [10]

    Public-key cryptosystems based on composite degree residu- osity classes,

    P. Paillier, “Public-key cryptosystems based on composite degree residu- osity classes,” in International conference on the theory and applications of cryptographic techniques . Springer, 1999, pp. 223–238

    1999

  3. [11]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , 2017...

    2017

  4. [12]

    Performance impact of differential privacy on federated learning in vehicular networks,

    E.-J. Kim and E.-K. Lee, “Performance impact of differential privacy on federated learning in vehicular networks,” in NOMS IEEE/IFIP Network Operations and Management Symposium . IEEE, 2022, pp. 1–5

    2022

  5. [13]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30, 2017

    2017

  6. [14]

    BV- ICVs: A privacy-preserving and verifiable federated learning framework for V2X environments using blockchain and zkSNARKs,

    A. Smahi, H. Li, Y . Yang, X. Yang, P. Lu, Y . Zhong, and C. Liu, “BV- ICVs: A privacy-preserving and verifiable federated learning framework for V2X environments using blockchain and zkSNARKs,” Journal of King Saud University-Computer and Information Sciences , vol. 35, no. 6...

    2023

  7. [15]

    Enhancing privacy preservation and trustworthiness for decentralized federated learning,

    L. Wang, X. Zhao, Z. Lu, L. Wang, and S. Zhang, “Enhancing privacy preservation and trustworthiness for decentralized federated learning,” Information Sciences, vol. 628, pp. 449–468, 2023

    2023

  8. [16]

    Nova: Recursive zero-knowledge arguments from folding schemes,

    A. Kothapalli, S. Setty, and I. Tzialla, “Nova: Recursive zero-knowledge arguments from folding schemes,” in Annual International Cryptology Conference. Springer, 2022, pp. 359–388

    2022

  9. [17]

    Incrementally verifiable computation or proofs of knowledge imply time/space efficiency,

    P. Valiant, “Incrementally verifiable computation or proofs of knowledge imply time/space efficiency,” in Theory of Cryptography: Fifth Theory of Cryptography Conference, (TCC), New York, USA . Springer, 2008, pp. 1–18

    2008

  10. [18]

    Privacy-preserving blockchain-based federated learning for IoT devices,

    Y . Zhao, J. Zhao, L. Jiang, R. Tan, D. Niyato, Z. Li, L. Lyu, and Y . Liu, “Privacy-preserving blockchain-based federated learning for IoT devices,” IEEE Internet of Things Journal , vol. 8, no. 3, pp. 1817–1829, 2020

    2020

  11. [19]

    Hybrid blockchain-based resource trading system for federated learning in edge computing,

    S. Fan, H. Zhang, Y . Zeng, and W. Cai, “Hybrid blockchain-based resource trading system for federated learning in edge computing,” IEEE Internet of Things Journal , vol. 8, no. 4, pp. 2252–2264, 2020

    2020

  12. [20]

    The security of machine learning,

    M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar, “The security of machine learning,” Machine learning, vol. 81, pp. 121–148, 2010

    2010

  13. [21]

    A blockchain based privacy-preserving federated learning scheme for internet of vehicles,

    N. Wang, W. Yang, X. Wang, L. Wu, Z. Guan, X. Du, and M. Guizani, “A blockchain based privacy-preserving federated learning scheme for internet of vehicles,” Digital Communications and Networks , 2022

    2022

  14. [22]

    Vdfchain: Secure and verifi- able decentralized federated learning via committee-based blockchain,

    M. Zhou, Z. Yang, H. Yu, and S. Yu, “Vdfchain: Secure and verifi- able decentralized federated learning via committee-based blockchain,” Journal of Network and Computer Applications , vol. 223, p. 103814, 2024

    2024

  15. [23]

    zkfl: Zero- knowledge proof-based gradient aggregation for federated learning,

    Z. Wang, N. Dong, J. Sun, W. Knottenbelt, and Y . Guo, “zkfl: Zero- knowledge proof-based gradient aggregation for federated learning,” IEEE Transactions on Big Data , 2024

    2024

  16. [24]

    On the size of pairing-based non-interactive arguments,

    J. Groth, “On the size of pairing-based non-interactive arguments,” in Advances in Cryptology–EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Cryptographic Tech- niques, Vienna, Austria, Proceedings, Part II 35 . Springer, 2016, pp. 305–326

    2016

  17. [25]

    Blockchain-based federated learning: A compre- hensive survey,

    Z. Wang and Q. Hu, “Blockchain-based federated learning: A compre- hensive survey,” arXiv preprint arXiv:2110.02182 , 2021

    2021 arXiv

  18. [26]

    Adversarial machine learning,

    L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. D. Tygar, “Adversarial machine learning,” in Proceedings of the 4th ACM workshop on Security and artificial intelligence , 2011, pp. 43–58

    2011

  19. [27]

    SCA: Sybil-based collusion attacks of IIoT data poisoning in federated learning,

    X. Xiao, Z. Tang, C. Li, B. Xiao, and K. Li, “SCA: Sybil-based collusion attacks of IIoT data poisoning in federated learning,” IEEE Transactions on Industrial Informatics , vol. 19, no. 3, pp. 2608–2618, 2022

    2022

  20. [28]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , “Advances and open problems in federated learning,” Foundations and Trends® in Machine Learning , vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  21. [29]

    Ipfs-content addressed, versioned, p2p file system,

    J. Benet, “Ipfs-content addressed, versioned, p2p file system,” arXiv preprint arXiv:1407.3561, 2014

    2014 arXiv

  22. [30]

    Practical byzantine fault tolerance,

    M. Castro and B. Liskov, “Practical byzantine fault tolerance,” in 3rd Symposium on Operating Systems Design and Implementation (OSDI 99). New Orleans, LA, USA: USENIX Association, 1999

    1999

  23. [31]

    Chainlink 2.0: Next steps in the evolution of decentralized oracle networks,

    L. Breidenbach, C. Cachin, B. Chan, A. Coventry, S. Ellis, A. Juels, F. Koushanfar, A. Miller, B. Magauran, D. Moroz et al., “Chainlink 2.0: Next steps in the evolution of decentralized oracle networks,” Chainlink Labs, vol. 1, pp. 1–136, 2021

    2021

  24. [32]

    The MNIST database of handwritten digits,

    Y . LeCun and C. Cortes, “The MNIST database of handwritten digits,”

  25. [2005]

    Available: https://api.semanticscholar.org/CorpusID: 60282629

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 60282629

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.