[Paper Review] RoFL: Attestable Robustness for Secure Federated Learning.

Lukas Burkhalter, Hidde Lycklama+3 more|arXiv (Cornell University)|Jul 7, 2021

Privacy-Preserving Technologies in Data71 references15 citations

TL;DR

RoFL is a secure federated learning system that enhances robustness against malicious clients by enabling zero-knowledge proofs to verify constraints on encrypted model updates. It extends secure aggregation with input checks via cryptographic proofs, enabling scalable, privacy-preserving training with strong security guarantees.

ABSTRACT

Federated Learning is an emerging decentralized machine learning paradigm that allows a large number of clients to train a joint model without the need to share their private data. Participants instead only share ephemeral updates necessary to train the model. To ensure the confidentiality of the client updates, Federated Learning systems employ secure aggregation; clients encrypt their gradient updates, and only the aggregated model is revealed to the server. Achieving this level of data protection, however, presents new challenges to the robustness of Federated Learning, i.e., the ability to tolerate failures and attacks. Unfortunately, in this setting, a malicious client can now easily exert influence on the model behavior without being detected. As Federated Learning is being deployed in practice in a range of sensitive applications, its robustness is growing in importance. In this paper, we take a step towards understanding and improving the robustness of secure Federated Learning. We start this paper with a systematic study that evaluates and analyzes existing attack vectors and discusses potential defenses and assesses their effectiveness. We then present RoFL, a secure Federated Learning system that improves robustness against malicious clients through input checks on the encrypted model updates. RoFL extends Federated Learning's secure aggregation protocol to allow expressing a variety of properties and constraints on model updates using zero-knowledge proofs. To enable RoFL to scale to typical Federated Learning settings, we introduce several ML and cryptographic optimizations specific to Federated Learning. We implement and evaluate a prototype of RoFL and show that realistic ML models can be trained in a reasonable time while improving robustness.

Motivation & Objective

• To address the growing risk of undetected malicious client behavior in secure federated learning, where encrypted updates can be manipulated without detection.
• To improve robustness in federated learning systems that rely on secure aggregation for data confidentiality.
• To design a system that allows verification of model update properties without revealing sensitive client data.
• To ensure scalability of verification mechanisms in real-world federated learning settings with large models and many clients.

Proposed method

• Extends the secure aggregation protocol to support zero-knowledge proofs that verify constraints on encrypted model updates.
• Employs zero-knowledge proofs to express and validate properties such as gradient norm bounds or sparsity without exposing raw updates.
• Introduces ML-specific optimizations to reduce the computational cost of proof generation and verification for large neural networks.
• Applies cryptographic optimizations tailored to federated learning workloads, including batched proof aggregation and efficient arithmetic circuits.
• Designs a protocol where clients submit encrypted updates along with zero-knowledge proofs of correctness, which the server verifies before aggregation.
• Ensures end-to-end privacy by maintaining confidentiality of client data while enabling verifiable robustness.

Experimental results

Research questions

• RQ1 How can malicious clients be prevented from manipulating model updates in secure federated learning without compromising data privacy?
• RQ2 What cryptographic mechanisms enable efficient and scalable verification of model update properties in encrypted form?
• RQ3 To what extent can zero-knowledge proofs be integrated into existing secure aggregation protocols without degrading training performance?
• RQ4 What optimizations are necessary to make proof-based verification practical for large-scale federated learning with deep learning models?

Key findings

• RoFL successfully enables verification of model update properties through zero-knowledge proofs without exposing raw client gradients.
• The system achieves practical performance, allowing realistic machine learning models to be trained in a reasonable time despite cryptographic overhead.
• The integration of zero-knowledge proofs into secure aggregation enhances robustness by detecting and rejecting malicious updates.
• ML and cryptographic optimizations significantly reduce proof generation and verification costs, making RoFL scalable for real-world deployment.
• RoFL maintains strong privacy guarantees while providing verifiable robustness, addressing a critical gap in secure federated learning.