Pith. sign in

REVIEW 3 major objections 6 minor 43 references

Hybrid homomorphic encryption lets weak clients train federated models privately with a 2,000x bandwidth cut.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pairing the PASTA stream cipher with BFV homomorphic encryption in federated learning cuts client upload by about 2000x and keeps MNIST accuracy within 1.3% of plaintext, but makes server aggregation roughly 15,000x more expensive.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection First real HHE-for-FL prototype with honest numbers, but the quantization encoding in the pseudocode and the single-malicious-client assumption need fixing before I'd trust the headline accuracy. the 3 major comments →

arxiv 2509.03427 v1 pith:KOMKBOBT submitted 2025-09-03 cs.CR

Federated Learning: An approach with Hybrid Homomorphic Encryption

Pedro Correia , Ivan Silva , Ivone Amorim , Eva Maia , Isabel Pra\c{c}a This is my paper
classification cs.CR
keywords federated learninghybrid homomorphic encryptionPASTA stream cipherBFVtranscipheringsecure aggregationprivacy-preserving machine learningMNIST
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes the first hybrid homomorphic encryption (HHE) framework for federated learning, pairing the lightweight PASTA symmetric cipher with the BFV fully homomorphic scheme. Clients encrypt their model updates with PASTA and send those small ciphertexts plus a homomorphically encrypted PASTA key to the server, which homomorphically converts them to BFV ciphertexts and securely aggregates. On an IID MNIST benchmark with 12 clients and 10 rounds, the system reaches 97.6% accuracy (1.3% below plaintext), cuts client upload traffic by over 2,000x, and reduces client runtime by 30% compared to pure BFV, while shifting a massive computational burden (roughly 15,621x server cost per client) to a well-provisioned server. If the approach scales, it would make privacy-preserving federated learning practical for resource-constrained IoT devices that cannot run FHE directly.

Core claim

The central claim is that hybrid homomorphic encryption can make federated learning with fully homomorphic encryption practical for weak clients, without sacrificing model quality. The authors build an end-to-end framework, integrated into the Flower federated learning system, where clients use the PASTA stream cipher for lightweight encryption of quantized local model updates, and the server performs a homomorphic evaluation of PASTA's decryption circuit (HESD) using the BFV scheme, converting the symmetric ciphertexts into BFV ciphertexts and then performing FedAvg aggregation. Experiments on IID MNIST with 12 clients and 10 rounds show 97.6% accuracy versus 98.9% for plaintext and 98.0% f

What carries the argument

The central object is the HESD (Homomorphic Evaluation of Symmetric Decryption) routine, built on the PASTA stream cipher and the BFV FHE scheme. PASTA is an HE-friendly stream cipher designed for low multiplicative depth over integers modulo a 16-bit prime, so its decryption circuit can be evaluated homomorphically with modest depth. The server receives the PASTA-encrypted weight chunks and the PASTA key encrypted under BFV, evaluates PASTA decryption to get BFV ciphertexts of the weights, and aggregates them homomorphically under FedAvg. The quantization to int8 and chunk-based processing enable the lightweight symmetric encryption on the client while keeping server-side circuit depth mana

Load-bearing premise

The paper assumes every client is honest and that no client colludes with the server or with other clients; in particular, it hands every client a copy of the homomorphic secret key, so one malicious client could decrypt another client's model update and break confidentiality.

What would settle it

Run the same HHE-FL protocol with one client replaced by a malicious participant who uses the shared HE secret key to decrypt the PASTA key of another client during the aggregation phase, and observe whether the victim's plaintext model update is recovered; if it is, the central confidentiality claim is disproved.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If scalable, this approach could enable privacy-preserving federated learning on IoT devices, smart wearables, and other resource-constrained hardware that cannot run FHE locally.
  • The 2000x upload reduction directly addresses the main communication bottleneck in cross-device federated learning, making the encryption overhead negligible compared to raw model updates.
  • The server-side cost, while high in this prototype, is amenable to parallelization across clients and chunks, as the authors note, and future HE-friendly ciphers could lower it.
  • The single-key distribution model means participating clients must decrypt the global model with the shared secret key, which reveals the aggregated model—a tension with strict confidentiality for individual updates.
  • The framework's end-to-end implementation on Flower provides a concrete reference for integrating HHE into existing federated learning stacks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The underlying design pattern—using a cheap symmetric cipher for the bulk of client work and FHE only for the aggregation server—could generalize beyond PASTA/BFV to other HE-friendly ciphers (e.g., RASTA, DASTA) and schemes (BGV, CKKS) with careful tuning of plaintext modulus and quantization.
  • The paper does not explore non-IID data or gradient inversion resistance; a testable extension would be to evaluate whether the HHE approach defends against gradient inversion attacks on non-IID partitions, where privacy leaks are more damaging.
  • The server-side 15,621x cost is reported per client; the authors' linear scaling model suggests that batched or GPU-optimized transciphering could close the gap, and a natural next experiment is to benchmark the same setup on a dedicated HE accelerator or multi-core server.
  • The shared HE secret key assumption is a fundamental bottleneck; a multi-key HHE design where each client has its own PASTA key and the server aggregates without decrypting individual updates would remove the single point of failure, at the cost of more complex HE operations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a hybrid homomorphic encryption (HHE) framework for federated learning that combines the PASTA symmetric cipher with the BFV FHE scheme. Clients encrypt local model updates with PASTA and send the lightweight ciphertexts together with a BFV-encrypted PASTA key to the server, which homomorphically evaluates PASTA decryption and aggregates the resulting BFV ciphertexts under FedAvg. A prototype built on Flower is evaluated on IID MNIST with 12 clients and 10 rounds; the paper reports roughly 97.4–97.6% accuracy versus about 99% for plaintext FL, a >2,000× reduction in client upload traffic, and a ~30% client-runtime reduction relative to pure BFV, at the cost of a very large server-side computation increase.

Significance. If the implementation is correct, this is a useful demonstration of transciphering in federated learning: it quantifies a realistic trade-off between client-side efficiency and server-side cost, and it builds on public PASTA/BFV implementations rather than proposing a new primitive. The paper is also transparent about the severe server overhead and about the fact that a single malicious client breaks confidentiality. However, the central empirical claim currently rests on an underspecified and, as written, incorrect signed-integer encoding in the quantization/encryption path, and the manuscript does not provide code to resolve the ambiguity. The shared HE secret key and honest-client assumption also substantially narrow the privacy claim, so the paper needs revision before the results can be accepted as reproducible and the contribution clearly scoped.

major comments (3)
  1. [§5, Algorithm 2 line 10; Algorithm 3 lines 10–14] The encoding of negative quantized weights is not specified and, as written, is incorrect under standard two's-complement semantics. With q=65537, converting an int8 value -k to uint64 yields 2^64-k ≡ 1-k (mod q). Algorithm 3's rule 'if x > q//2 then x -= q' then decodes -1 to 0, -2 to -1, -3 to -2, etc. Positive weights are unaffected, but negative weights—which certainly occur in the CNN—are systematically corrupted. The reported 97.6% accuracy therefore cannot be reproduced from the pseudocode unless the implementation uses a different encoding (e.g., x mod q, an offset, or PASTA-specific limb handling). Please specify the exact modular mapping in the algorithms and make the code available; this is a correctness issue, not a tuning issue.
  2. [§6.2, parameter constraints] The overflow bound is stated as 2^8 × 2^{x1} × 2^{x2} < 2^16+1, with x1 'the number of batches per client' and x2 'the number of training clients', and valid configurations must satisfy 2^{x1+x2} ≤ 2^8. The chosen configuration has x1=63 and x2=4, which contradicts this inequality. Either x1 is intended to be log2 of the number of batches, or the inequality should be a product such as 2^8 · x1 · x2 < q (the chosen 63×4×127 product satisfies the latter). Please correct the formula and explain the derivation, since this is the stated basis for the configuration selection.
  3. [§4.1–4.2, threat model and SP.1–SP.3] Because every client holds HE sk, the confidentiality guarantees SP.1–SP.3 hold only while all clients are honest and no client colludes with the server or another client. The paper itself concedes that a single malicious client can decrypt an honest client's PASTA key and therefore its update. This assumption is stronger than the honest-but-curious server that motivates the work, and it substantially narrows the 'end-to-end privacy' claim in the abstract. Please state the honest-client assumption explicitly in the abstract and conclusions, and discuss the implications for the cross-device FL scenarios the paper targets.
minor comments (6)
  1. [Abstract, §1, Table 2] Numerical inconsistencies: the abstract and introduction report HHE accuracy 97.6%, plaintext 98.9%, BFV 98.04%, while Table 2 reports 97.39%, 99.00%, and 98.21%. These should be reconciled; the claimed '1.3% below plaintext' changes to about 1.6% when using Table 2.
  2. [§6.2] The sentence '12 clients, each with 63 training batches, where 4 were used for training and 12 for evaluation' is unclear. I assume it means 4 clients participate in each training phase and 12 in each evaluation phase; please reword.
  3. [§4.1 / Algorithm 1] The HESD procedure is described at a high level only. Since the PASTA decryption circuit is the main server-side cost, a short description of its structure and the number of homomorphic multiplications would aid reproducibility.
  4. [Algorithm 3, line 17] The division by n implicitly assumes equal client dataset sizes. For general FedAvg with unequal n_k, the server must first scale each client's update by n_k before summing. Please state this assumption or adjust the pseudocode.
  5. [Throughout] No repository link or code artifact is provided. Given the encoding ambiguity in Algorithm 2, making the implementation available is essential for reproducibility.
  6. [Throughout] Minor typos: 'Backgound' in the Section 2 heading, 'measured has' in §6.3, and 'serve' in SP.2.

Circularity Check

0 steps flagged

No significant circularity: all headline numbers are measured prototype results, not derivations from fitted or self-cited inputs.

full rationale

The paper's central claims are empirical measurements from a prototype, not derived quantities. The reported accuracy, runtime, and bandwidth figures come from executing the implemented system in Section 6.3, compared against plaintext and BFV baselines. No claim reduces by the paper's own equations to a fitted or self-cited value. The quantization scale α=5 is tuned by observation (Section 6.2, 'The value for α was chosen based on empirical observations of the model’s typical output range'), but accuracy is then measured, not predicted from α; the same holds for the bandwidth and server-cost ratios, which are measured ratios of ciphertext sizes and wall-clock times. The cryptographic components (PASTA, BFV) are external prior work with public implementations, cited in Section 5 ('PASTA was integrated in our prototype using the authors’ open-source C++ framework'), so no self-citation chain is load-bearing. The limitation passages (Section 4.2: 'A single malicious client could compromise confidentiality...'; Section 7: 'since BFV lacks real-number division, clients had to perform weighted averaging locally, posing a potential privacy issue') were reviewed; they are substantive threat-model and correctness caveats, not circular reasoning. The pseudocode in Algorithm 2 (int8-to-uint64 conversion) raises a potential reproducibility/correctness concern, but that is orthogonal to circularity. Overall, the derivation chain is self-contained: the numbers are observed outcomes of a prototype, and no step is equivalent to its own input.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

No new cryptographic primitives are introduced: PASTA and BFV are adopted from prior work. The load-bearing items are the external security properties of PASTA and the chosen BFV parameters, the stated threat model, and the paper's own modulus-bound arithmetic, which is internally inconsistent as written. The free parameters are the quantization scheme and the demonstration configuration, both tuned to the tiny plaintext modulus (2^16+1) and the Colab environment.

free parameters (3)
  • clip range alpha = 5
    Chosen from empirical observations of the model's typical output range across several runs (Section 6.2); controls the quantization scale and therefore the reported 1.3% accuracy drop.
  • quantization bit width b = 8 (int8)
    Hand-chosen in Section 6.1; sets the 2^8 factor in the modulus constraint and the quantization noise that contributes to the accuracy gap.
  • training configuration = 12 clients, 63 batches per client, 4 clients per training phase, 10 rounds
    Selected to satisfy the plaintext modulus bound and Colab's 24-hour limit (Section 6.2); all reported results are specific to this tiny scale.
axioms (4)
  • domain assumption PASTA is a secure stream cipher whose decryption circuit is shallow enough for efficient BFV evaluation.
    Adopted from Dobraunig et al. (ref [10]) via the authors' open-source C++ framework; the paper neither re-derives PASTA security nor proves the HESD circuit depth, it relies on the cipher's stated design goal.
  • domain assumption The chosen BFV parameters (polynomial degree 16384, plaintext modulus 65537) provide 128-bit security and enough noise budget for HESD plus aggregation.
    Table 1 lists the parameters but not the ciphertext modulus or noise budget; the 128-bit security claim and the correctness of the 1451-second HESD run are asserted, not derived or formally verified.
  • ad hoc to paper All server-side arithmetic stays inside Z_65537: 2^8 * 2^(x1+x2) < 2^16+1 with x1 batches per client and x2 training clients.
    This bound is introduced in Section 6.2 to justify the small configuration; as literally stated it contradicts the chosen 63 batches and 4 training clients, and the paper provides no check that plaintext values do not wrap during aggregation.
  • domain assumption Threat model: trusted setup, honest clients, honest-but-curious server, no collusion (A.1-A.5).
    The security guarantees SP.1-SP.3 in Section 4.2 are conditional on these assumptions; the paper concedes that one malicious client breaks confidentiality, so the privacy claim is only as strong as the honesty assumption.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Federated Learning: An approach with Hybrid Homomorphic Encryption." pith.science (2026). https://pith.science/paper/KOMKBOBT

@misc{pith2026250903427,
  author       = {Pith},
  title        = {Pith review of: Federated Learning: An approach with Hybrid Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KOMKBOBT}},
  note         = {Machine review of arXiv:2509.03427}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated Learning (FL) is a distributed machine learning approach that promises privacy by keeping the data on the device. However, gradient reconstruction and membership-inference attacks show that model updates still leak information. Fully Homomorphic Encryption (FHE) can address those privacy concerns but it suffers from ciphertext expansion and requires prohibitive overhead on resource-constrained devices. We propose the first Hybrid Homomorphic Encryption (HHE) framework for FL that pairs the PASTA symmetric cipher with the BFV FHE scheme. Clients encrypt local model updates with PASTA and send both the lightweight ciphertexts and the PASTA key (itself BFV-encrypted) to the server, which performs a homomorphic evaluation of the decryption circuit of PASTA and aggregates the resulting BFV ciphertexts. A prototype implementation, developed on top of the Flower FL framework, shows that on independently and identically distributed MNIST dataset with 12 clients and 10 training rounds, the proposed HHE system achieves 97.6% accuracy, just 1.3% below plaintext, while reducing client upload bandwidth by over 2,000x and cutting client runtime by 30% compared to a system based solely on the BFV FHE scheme. However, server computational cost increases by roughly 15621x for each client participating in the training phase, a challenge to be addressed in future work.

Figures

Figures reproduced from arXiv: 2509.03427 by Eva Maia, Isabel Pra\c{c}a, Ivan Silva, Ivone Amorim, Pedro Correia.

Figure 1
Figure 1. Figure 1: Federated Learning Architecture Federated Averaging (FedAvg) is the most used aggregation algorithm, which performs weighted averaging of client updates based on local dataset sizes [26]. Let K be the number of participating clients in a training round. For each client k ∈ {1, . . . , K}, let nk be the number of local training samples, and let n = PK k=1 nk be the total number of data samples across all pa… view at source ↗
Figure 2
Figure 2. Figure 2: FL Architecture with HHE Server Aggregation Phase The Server Aggregation Phase occurs after ev￾ery Client Training Phase in each round of the FL process. During this phase, the server receives the wSKE along with the corresponding homomorphically en￾crypted secret key skHE from the selected clients. The server then applies HESD on each wSKE, using the associated skHE. Once all updates are transformed, the … view at source ↗
Figure 3
Figure 3. Figure 3: Workflow of the proposed solution 4.2 Threat Model The security of the proposed solution is based on the following assumptions about the system setup and participants: A.1. The Setup Phase is trusted: all cryptographic keys and the initial global weights are generated and distributed securely, with no adversarial interference; A.2. All clients are honest: meaning they execute the protocol faithfully withou… view at source ↗
Figure 4
Figure 4. Figure 4: Prototype Implementation Architecture. FL Layer Several FL frameworks were analyzed and compared based on learn￾ing modes, privacy-preserving mechanisms, encryption support, and scalability. Flower, proposed by Beutel et al. [4], was selected for its high customizabil￾ity, scalability, cloud compatibility, and the availability of a HE integration by Catalfamo et al. [6]. Since Flower is Python-based and th… view at source ↗
Figure 5
Figure 5. Figure 5: Training Performance Across Rounds: (a) Accuracy; (b) Loss [PITH_FULL_IMAGE:figures/full_fig_p015_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Communication cost comparison (values are shown on a logarithmic scale [PITH_FULL_IMAGE:figures/full_fig_p015_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Average Computation Cost: (a) Client; (b) Server Aggregation Phase [PITH_FULL_IMAGE:figures/full_fig_p015_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Runtime Overhead of HESD with Increasing Parameters [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

43 extracted references · 29 canonical work pages · 1 internal anchor

  1. [1]

    Cryptology ePrint Archive, Paper 2025/071 (2025), https://eprint.iacr.org/2025/071

    Abdinasibfar, H., Nuoskala, C., Michalas, A.: The HHE land: Exploring the landscape of hybrid homomorphic encryption. Cryptology ePrint Archive, Paper 2025/071 (2025), https://eprint.iacr.org/2025/071

    work page 2025

  2. [2]

    IEEE Access 8, 140699– 140725 (2020)

    Aledhari, M., Razzak, R., Parizi, R.M., Saeed, F.: Federated Learning: A Survey on Enabling Technologies, Protocols, and Applications. IEEE Access 8, 140699– 140725 (2020). https://doi.org/10.1109/ACCESS.2020.3013541

    work page arXiv 2020

  3. [3]

    https: //doi.org/10.48550/arXiv.2104.03152

    Benaissa, A., Retiat, B., Cebere, B., Belfedhal, A.E.: TenSEAL: A Library for Encrypted Tensor Operations Using Homomorphic Encryption (Apr 2021). https: //doi.org/10.48550/arXiv.2104.03152

    Pith/arXiv arXiv doi:10.48550/arxiv.2104.03152 2021

  4. [4]

    https://doi.org/10.48550/ arXiv.2007.14390

    Beutel, D.J., Topal, T., Mathur, A., Qiu, X., Fernandez-Marques, J., Gao, Y., Sani, L., Li, K.H., Parcollet, T., de Gusm˜ ao, P.P.B., Lane, N.D.: Flower: A Friendly Federated Learning Research Framework (Mar 2022). https://doi.org/10.48550/ arXiv.2007.14390

    Pith/arXiv arXiv doi:10.48550/arxiv.2007.14390 2022

  5. [5]

    Cryptology ePrint Archive, Paper 2011/277 (2011), https: //eprint.iacr.org/2011/277

    Brakerski, Z., Gentry, C., Vaikuntanathan, V.: Fully homomorphic encryption without bootstrapping. Cryptology ePrint Archive, Paper 2011/277 (2011), https: //eprint.iacr.org/2011/277

    work page 2011

  6. [6]

    In: 2024 IEEE Symposium on Computers and Communications (ISCC)

    Catalfamo, A., Carnevale, L., Garofalo, M., Villari, M.: Flower Full-Compliant Implementation of Federated Learning with Homomorphic Encryption. In: 2024 IEEE Symposium on Computers and Communications (ISCC). pp. 1–5 (Jun 2024). https://doi.org/10.1109/ISCC61673.2024.10733641

    arXiv 2024

  7. [7]

    In: Takagi, T., Peyrin, T

    Cheon, J.H., Kim, A., Kim, M., Song, Y.: Homomorphic encryption for arithmetic of approximate numbers. In: Takagi, T., Peyrin, T. (eds.) Advances in Cryptology – ASIACRYPT 2017. pp. 409–437. Springer International Publishing, Cham (2017). https://doi.org/10.1007/978-3-319-70694-8 15

    doi:10.1007/978-3-319-70694-8 2017

  8. [8]

    Chillotti, I., Gama, N., Georgieva, M., Izabach` ene, M.: TFHE: Fast fully ho- momorphic encryption over the torus. J. Cryptology 33(1), 34–91 (Jan 2020). https://doi.org/10.1007/s00145-019-09319-x

    doi:10.1007/s00145-019-09319-x 2020

  9. [9]

    In: Shacham, H., Boldyreva, A

    Dobraunig, C., Eichlseder, M., Grassi, L., Lallemand, V., Leander, G., List, E., Mendel, F., Rechberger, C.: Rasta: A cipher with low anddepth and few ands per bit. In: Shacham, H., Boldyreva, A. (eds.) Advances in Cryptology – CRYPTO

    work page

  10. [10]

    Cryptology ePrint Archive, Paper 2021/731 (2021), https://eprint.iacr.org/2021/731

    Dobraunig, C., Grassi, L., Helminger, L., Rechberger, C., Schofnegger, M., Walch, R.: Pasta: A case for hybrid homomorphic encryption. Cryptology ePrint Archive, Paper 2021/731 (2021), https://eprint.iacr.org/2021/731

    work page 2021

  11. [11]

    Proceedings of the IEEE pp

    Dowlin, N., Gilad-Bachrach, R., Laine, K., Lauter, K., Naehrig, M., Wernsing, J.: Manual for Using Homomorphic Encryption for Bioinformatics. Proceedings of the IEEE pp. 1–16; (2017). https://doi.org/10.1109/JPROC.2016.2622218

    work page arXiv 2017

  12. [12]

    Internet of Things 24, 100966 (Dec 2023)

    Duy, P.T., Quyen, N.H., Khoa, N.H., Tran, T.D., Pham, V.H.: FedChain-Hunter: A reliable and privacy-preserving aggregation for federated threat hunting framework in SDN-based IIoT. Internet of Things 24, 100966 (Dec 2023). https://doi.org/10. 1016/j.iot.2023.100966

    work page arXiv 2023

  13. [13]

    Cryp- tology ePrint Archive, Paper 2012/144 (2012), https://eprint.iacr.org/2012/144

    Fan, J., Vercauteren, F.: Somewhat practical fully homomorphic encryption. Cryp- tology ePrint Archive, Paper 2012/144 (2012), https://eprint.iacr.org/2012/144

    work page 2012

  14. [14]

    Future Generation Computer Sys- tems 149, 200–211 (Dec 2023)

    Fontenla-Romero, O.e.a.: FedHEONN: Federated and homomorphically encrypted learning method for one-layer neural networks. Future Generation Computer Sys- tems 149, 200–211 (Dec 2023). https://doi.org/10.1016/j.future.2023.07.018 18 P. Correia et al

    work page doi:10.1016/j.future.2023.07.018 2023

  15. [15]

    In: Proceedings of the 41st Annual ACM Symposium on Theory of Computing

    Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Proceedings of the 41st Annual ACM Symposium on Theory of Computing. p. 169–178. STOC ’09, Association for Computing Machinery, New York, NY, USA (2009). https: //doi.org/10.1145/1536414.1536440

    arXiv 2009

  16. [16]

    Cryptology ePrint Archive, Paper 2020/1481 (2020), https: //eprint.iacr.org/2020/1481

    Halevi, S., Shoup, V.: Design and implementation of HElib: a homomorphic encryption library. Cryptology ePrint Archive, Paper 2020/1481 (2020), https: //eprint.iacr.org/2020/1481

    work page 2020

  17. [17]

    IACR Trans- actions on Symmetric Cryptology 2020(3), 46–86 (Sep 2020)

    Hebborn, P., Leander, G.: Dasta – alternative linear layer for rasta. IACR Trans- actions on Symmetric Cryptology 2020(3), 46–86 (Sep 2020). https://doi.org/10. 13154/tosc.v2020.i3.46-86

    work page 2020

  18. [18]

    Computer Communications 228, 107948 (Dec 2024)

    Hijazi, N.M., Aloqaily, M., Guizani, M.: Collaborative IoT learning with secure peer-to-peer federated approach. Computer Communications 228, 107948 (Dec 2024). https://doi.org/10.1016/j.comcom.2024.107948

    work page arXiv 2024

  19. [19]

    In: International Workshop on Federated Learning in the Age of Foundation Models in Conjunction with NeurIPS 2023 (2023), https: //openreview.net/forum?id=PuYD0fh5aq

    Jin, W., Yao, Y., Han, S., Joe-Wong, C., Ravi, S., Avestimehr, S., He, C.: FedML-HE: An efficient homomorphic-encryption-based privacy-preserving fed- erated learning system. In: International Workshop on Federated Learning in the Age of Foundation Models in Conjunction with NeurIPS 2023 (2023), https: //openreview.net/forum?id=PuYD0fh5aq

    work page 2023

  20. [20]

    https://doi.org/10.48550/arXiv.1912.04977

    Kairouz, P., McMahan, H.B., et al.: Advances and Open Problems in Federated Learning (Mar 2021). https://doi.org/10.48550/arXiv.1912.04977

    Pith/arXiv arXiv doi:10.48550/arxiv.1912.04977 2021

  21. [21]

    https://doi.org/10.48550/arXiv.2411.02530

    Lang, J., Guo, Z., Huang, S.: A comprehensive study on quantization techniques for large language models (Oct 2024). https://doi.org/10.48550/arXiv.2411.02530

    Pith/arXiv arXiv doi:10.48550/arxiv.2411.02530 2024

  22. [22]

    https://doi.org/10.48550/arXiv.2503.07505

    Li, Q., Yu, W., Xia, Y., Pang, J.: From Centralized to Decentralized Federated Learning: Theoretical Insights, Privacy Preservation, and Robustness Challenges (Mar 2025). https://doi.org/10.48550/arXiv.2503.07505

    Pith/arXiv arXiv doi:10.48550/arxiv.2503.07505 2025

  23. [23]

    International Journal of Intelligent Systems 37(9), 5880–5901 (2022)

    Ma, J., Naas, S.A., Sigg, S., Lyu, X.: Privacy-preserving federated learning based on multi-key homomorphic encryption. International Journal of Intelligent Systems 37(9), 5880–5901 (2022). https://doi.org/10.1002/int.22818

    doi:10.1002/int.22818 2022

  24. [24]

    In: 2021 International Con- ference on Information Networking (ICOIN)

    Majeed, U., Hassan, S.S., Hong, C.S.: Cross-Silo Model-Based Secure Federated Transfer Learning for Flow-Based Traffic Classification. In: 2021 International Con- ference on Information Networking (ICOIN). pp. 588–593. IEEE, Jeju Island, Ko- rea (South) (Jan 2021). https://doi.org/10.1109/ICOIN50884.2021.9333905

    arXiv 2021

  25. [25]

    Proceedings of the IEEE 110(10), 1572–1609 (2022)

    Marcolla, C., Sucasas, V., Manzano, M., Bassoli, R., Fitzek, F.H.P., Aaraj, N.: Survey on fully homomorphic encryption, theory, and applications. Proceedings of the IEEE 110(10), 1572–1609 (2022). https://doi.org/10.1109/JPROC.2022. 3205665

    doi:10.1109/jproc.2022 2022

  26. [26]

    McMahan, H.B., E, M., D, R., S., H., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data (2023), https://arxiv.org/abs/ 1602.05629

    Pith/arXiv arXiv 2023

  27. [27]

    Naehrig, M., Lauter, K., Vaikuntanathan, V.: Can homomorphic encryption be practical? In: Proceedings of the 3rd ACM Workshop on Cloud Computing Security Workshop. p. 113–124. CCSW ’11, Association for Computing Machinery, New York, NY, USA (2011), https://doi.org/10.1145/2046660.2046682

    work page arXiv 2011

  28. [28]

    Journal of Information and Intelligence 2(5), 404–454 (2024)

    Niu, J., Liu, P., et al.: A survey on membership inference attacks and defenses in machine learning. Journal of Information and Intelligence 2(5), 404–454 (2024). https://doi.org/10.1016/j.jiixd.2024.02.001

    work page doi:10.1016/j.jiixd.2024.02.001 2024

  29. [29]

    In: 2023 57th An- nual Conference on Information Sciences and Systems (CISS)

    Ovi, P.R., Gangopadhyay, A.: A comprehensive study of gradient inversion at- tacks in federated learning and baseline defense strategies. In: 2023 57th An- nual Conference on Information Sciences and Systems (CISS). pp. 1–6 (2023). https://doi.org/10.1109/CISS56502.2023.10089719 Federated Learning: An approach with Hybrid Homomorphic Encryption 19

    work page arXiv 2023

  30. [30]

    In: Huang, D.S., Chen, W., Pan, Y

    Qian, J., Wei, K., Wu, Y., Zhang, J., Chen, J., Bao, H.: Gi-smn: Gradient in- version attack against federated learning without prior knowledge. In: Huang, D.S., Chen, W., Pan, Y. (eds.) Advanced Intelligent Computing Technology and Applications. pp. 439–448. Springer Nature Singapore, Singapore (2024). https: //doi.org/10.1007/978-981-97-5603-2 36

    work page doi:10.1007/978-981-97-5603-2 2024

  31. [31]

    IEEE Transactions on Consumer Electronics 70(1), 4258–4265 (Feb 2024)

    Rabieinejad, E., Yazdinejad, A., Dehghantanha, A., Srivastava, G.: Two-Level Privacy-Preserving Framework: Federated Learning for Attack Detection in the Consumer Internet of Things. IEEE Transactions on Consumer Electronics 70(1), 4258–4265 (Feb 2024). https://doi.org/10.1109/TCE.2024.3349490

    arXiv 2024

  32. [32]

    A Review of Homomorphic Encryption Libraries for Secure Computation

    Sathya, S.S., Vepakomma, P., Raskar, R., Ramachandra, R., Bhattacharya, S.: A Review of Homomorphic Encryption Libraries for Secure Computation (Dec 2018). https://doi.org/10.48550/arXiv.1812.02428

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1812.02428 2018

  33. [33]

    Sharma, G.: Mnist cnn with 8k parameters (2020), https://www.kaggle.com/code/ gauravsharma99/mnist-8k-parameters, accessed: 2025-06-11

    work page 2020

  34. [34]

    Electronics 13(13), 2620 (Jan 2024)

    Song, C., Wang, Z., Peng, W., Yang, N.: Secure and Efficient Federated Learning Schemes for Healthcare Systems. Electronics 13(13), 2620 (Jan 2024). https:// doi.org/10.3390/electronics13132620

    work page doi:10.3390/electronics13132620 2024

  35. [35]

    In: SECRYPT 2022 - 19th International Conference on Security and Cryptography

    Stan, O., Thouvenot, V., Boudguiga, A., Kapusta, K., Zuber, M., Sirdey, R.: A Se- cure Federated Learning: Analysis of different cryptographic tools. In: SECRYPT 2022 - 19th International Conference on Security and Cryptography. vol. 1, p. 669 (Jul 2022). https://doi.org/10.5220/0011322700003283

    work page doi:10.5220/0011322700003283 2022

  36. [36]

    Journal of Network and Computer Applications 231, 103996 (Nov 2024)

    Tan, Z.S., See-To, E.W., Lee, K.Y., Dai, H.N., Wong, M.L.: Privacy-preserving fed- erated learning for proactive maintenance of IoT-empowered multi-location smart city facilities. Journal of Network and Computer Applications 231, 103996 (Nov 2024). https://doi.org/10.1016/j.jnca.2024.103996

    work page arXiv 2024

  37. [37]

    PLOS ONE 19 (10 2024)

    Wang, J., Yang, K., Li, M.: Nids-fgpa: A federated learning network intrusion detection algorithm based on secure aggregation of gradient similarity models. PLOS ONE 19 (10 2024). https://doi.org/10.1371/journal.pone.0308639

    work page doi:10.1371/journal.pone.0308639 2024

  38. [38]

    Computer Networks 249, 110465 (Jul 2024)

    Xu, Y., Mao, Y., Li, J., Chen, X., Wu, S.: Edge server enhanced secure and privacy preserving federated learning. Computer Networks 249, 110465 (Jul 2024). https: //doi.org/10.1016/j.comnet.2024.110465

    work page arXiv 2024

  39. [39]

    Yu, S., Cui, L.: Inference Attacks and Counterattacks in Federated Learning, pp. 13–36. Springer Nature Singapore, Singapore (2023). https://doi.org/10.1007/ 978-981-19-8692-5

    work page 2023

  40. [40]

    IEEE Transactions on Network Science and Engineering10(5), 2864– 2880 (Sep 2023)

    Zhang, L., Xu, J., Vijayakumar, P., Sharma, P.K., Ghosh, U.: Homomorphic Encryption-Based Privacy-Preserving Federated Learning in IoT-Enabled Health- care System. IEEE Transactions on Network Science and Engineering10(5), 2864– 2880 (Sep 2023). https://doi.org/10.1109/TNSE.2022.3185327

    work page arXiv 2023

  41. [41]

    IEEE Transactions on Information Forensics and Security18, 5804–5816 (2023)

    Zhang, M., Chen, S., Shen, J., Susilo, W.: PrivacyEAFL: Privacy-Enhanced Ag- gregation for Federated Learning in Mobile Crowdsensing. IEEE Transactions on Information Forensics and Security18, 5804–5816 (2023). https://doi.org/10.1109/ TIFS.2023.3315526

    work page arXiv 2023

  42. [42]

    In: Proceedings of the 2024 International Academic Conference on Edge Computing, Parallel and Distributed Computing

    Zhang, Y., Zhang, W., Shen, C.: A fault-tolerant federated learning scheme based on multi-key homomorphic encryption. In: Proceedings of the 2024 International Academic Conference on Edge Computing, Parallel and Distributed Computing. pp. 96–101. ECPDC ’24, Association for Computing Machinery, New York, NY, USA (Aug 2024). https://doi.org/10.1145/3677404.3677421

    work page arXiv 2024

  43. [2018]

    pp. 662–692. Springer International Publishing, Cham (2018). https://doi. org/10.1007/978-3-319-96884-1 22

    work page doi:10.1007/978-3-319-96884-1 2018

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.