PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

# PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning
Source: [https://arxiv.org/html/2607.06612](https://arxiv.org/html/2607.06612)
###### Abstract

Federated Learning \(FL\) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy\. However, traditional FL frameworks rely on a centralized aggregation server and assume honest\-but\-curious clients, making them susceptible to both server\-side inference and client\-side poisoning attacks\. Although recent work has explored secure and Byzantine\-resilient FL protocols, they face a fundamental trade\-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives\.

In this work, we proposePRoVeFL–a novel, modular FL framework that isPrivacy\-preserving, Byzantine\-Robust, and ensuresVerifiable aggregation\.PRoVeFLemploys multiple servers leveraging multi\-key fully homomorphic encryption\. Each client encrypts its local model updates and distributes encrypted shares to all servers\. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules\.PRoVeFLis compatible with a wide range of state\-of\-the\-art Byzantine\-robust aggregation algorithms \(e\.g\., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more\) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server\. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants\.PRoVeFLimproves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100×\\timesand 10×\\times, respectively\.

###### keywords:

Federated learning, Byzantine\-robust aggregation, Multi\-key homomorphic encryption, Verifiable aggregation, Privacy\-preserving machine learning

††journal:arXiv\\affiliation

\[label1\]organization=Indian Institute of Technology \(BHU\), city=Varanasi, country=India\\affiliation\[label2\]organization=Vaulttree, city=, country=Ireland\\affiliation\[label3\]organization=University of Warwick, city=Coventry, country=UK\\affiliation\[label4\]organization=University of Oxford, city=Oxford, country=UK\\affiliation\[label5\]organization=Abdullah Gul University, city=Kayseri, country=Turkiye

## 1Introduction

Federated Learning \(FL\) allows the development of a privacy\-preserving distributed machine learning \(ML\) model for multiple clients to jointly train, without directly sharing their local data\[[38](https://arxiv.org/html/2607.06612#bib.bib39),[37](https://arxiv.org/html/2607.06612#bib.bib38)\]\. By decentralizing model training, FL offers significant advantages for sensitive applications such as healthcare and finance, where data is often fragmented between institutions, each bound by strict regulatory constraints and business competition\[[49](https://arxiv.org/html/2607.06612#bib.bib57)\]\. In its standard design, a single server maintains a global ML model and incrementally updates it by aggregating local gradient updates sent by multiple clients\. However, such a design is open to security and privacy threats\[[39](https://arxiv.org/html/2607.06612#bib.bib4)\]; in particular, an adversary can exploit model updates toinferprivate information\[[40](https://arxiv.org/html/2607.06612#bib.bib3),[36](https://arxiv.org/html/2607.06612#bib.bib1)\]ormanipulatethe aggregation process if the server is compromised\[[16](https://arxiv.org/html/2607.06612#bib.bib35)\], and the global model can bepoisonedif clients are compromised\[[13](https://arxiv.org/html/2607.06612#bib.bib37),[50](https://arxiv.org/html/2607.06612#bib.bib36),[28](https://arxiv.org/html/2607.06612#bib.bib9)\]\.

To address such threats, three interrelated properties should be achieved together: privacy, Byzantine robustness, and verifiability\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\]\. Just hiding raw data is not sufficient for privacy\. As several studies\[[16](https://arxiv.org/html/2607.06612#bib.bib35),[25](https://arxiv.org/html/2607.06612#bib.bib34)\]have confirmed, gradient updates can leak private information\. Thus, other privacy\-enhancing technologies \(PETs\), such as Secure Multi\-Party Computation \(SMPC\), Fully Homomorphic Encryption \(FHE\), and Differential Privacy \(DP\), are integrated to enhance privacy\. While such protocols can hide clients’ updates from the server, they can also make it harder to identify malicious updates\. Recent work has proposed to combine secure aggregation with robustness measures, yet these often incur high computational and communication costs or rely on relaxed trust assumptions\. They are not flexible enough to support a variety of Byzantine\-robust aggregation rules, and instead enforce simple heuristics, such as via norm clipping\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\]\. Other approaches, such as MUDGUARD\[[51](https://arxiv.org/html/2607.06612#bib.bib49)\], employ a privacy\-preserving clustering method\. This can protect the global model against most malicious clients, but it significantly increases the complexity and cost of aggregation\. Similarly, ELSA\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\], ACORN\[[4](https://arxiv.org/html/2607.06612#bib.bib62)\], and EIFFeL\[[44](https://arxiv.org/html/2607.06612#bib.bib64)\]integrate zero\-knowledge proofs or integrity checks into the secure aggregation to mitigate the impact of malicious clients by enforcing specified bounds or norms on client updates\. However, they do not align with the current round distribution of local model updates; instead, they treat the previous global model update as the trusted reference\. It has also been shown that secure aggregations performed in vanilla FL settings are not secure, and can still leak sensitive and private information\[[19](https://arxiv.org/html/2607.06612#bib.bib33)\]\.

The third critical property is the verifiability of the aggregation process\. In standard FL, clients are often assumed to trust that the central server honestly performs the intended aggregation\. However, a malicious or compromised server could deviate from the protocol by injecting maliciously crafted updates, omitting certain client contributions, or altering the aggregated result\. Thus, it is important to verify that the server’s reported global model update truly corresponds to thecorrect aggregation, while correctly penalizing the malicious updates\. Protocols focusing on verifiable aggregation \(e\.g\.,VerifyNet\[[53](https://arxiv.org/html/2607.06612#bib.bib65)\]or SVeriFL\[[18](https://arxiv.org/html/2607.06612#bib.bib66)\]\) enable clients to detect server misbehaviors by requiring the server to produce cryptographic proofs of aggregation\. However, they assume that all client updates aggregated are legitimate\. It is a significant challenge to simultaneously achieve all three properties—client update privacy, Byzantine robustness, and server verifiability\. Existing methods designed to achieve any of these obstruct or contradict the others\.

Fully Homomorphic Encryption \(FHE\)\[[21](https://arxiv.org/html/2607.06612#bib.bib23),[9](https://arxiv.org/html/2607.06612#bib.bib22)\]holds promise for achieving the key security properties by enabling computation directly over encrypted data and providing strong privacy guarantees without the need for trusted third parties\. Furthermore, FHE can support Byzantine robustness and verifiability by enabling secure, auditable computation pipelines\. Recent works such as FedML\-HE\[[27](https://arxiv.org/html/2607.06612#bib.bib26)\], xMK\-CKKS\[[34](https://arxiv.org/html/2607.06612#bib.bib24)\], and tMK\-CKKS\[[12](https://arxiv.org/html/2607.06612#bib.bib25)\]have demonstrated these capabilities to some extent\. However, these systems still suffer from significant computational overhead and are not ready for adoption\. In particular, the non\-linear, comparison\-based logic used in Byzantine\-resilient rules remains expensive to implement\. Ensuring verifiability within a purely FHE\-based framework often requires expensive zero\-knowledge proofs or complex cryptographic commitments, further increasing costs\. These limitations hinder scalability, make the protocols impractical for real\-time systems, and restrict their applicability\.

### 1\.1Our Contribution\.

This paper proposes a genericPrivate,Robust, andVerifiable FL \(PRoVeFL\) framework to address the above challenges and ensure clients’ privacy, Byzantine\-robustness, and aggregation verifiability simultaneously\.PRoVeFLis scalable with a modular multi\-server architecture to address the computational and communication inefficiencies inherent in secure aggregation protocols\. Unlike a conventional single\-server FL system,PRoVeFLpartitions the model parameters \(1\) to distribute the computational load and \(2\) to enable offloading portions of the ciphertext\-domain computation to the plaintext domain, without compromising privacy\. This partitioning enables threshold decryption on a small number of servers, which would be infeasible with a large number of clients\. By aligning the partitioning with CKKS\-specific parameters such as the polynomial modulus degree, we maximize ciphertext packing efficiency, reduce the need for zero\-padding, and thereby minimize computational and communication costs\.

PRoVeFLensures that client updates remain private from the servers unless all of them collude\. Using multi\-key homomorphic encryption, the protocol guarantees privacy as long as at least one server is honest, extending the threat model considered in ELSA\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\], and SafeFL\[[20](https://arxiv.org/html/2607.06612#bib.bib50)\]\. It further extends the verification guarantees of MUDGUARD\[[51](https://arxiv.org/html/2607.06612#bib.bib49)\], and Franzese et al\.\[[14](https://arxiv.org/html/2607.06612#bib.bib54)\]by verifying the correctness of the aggregation and the server’s enforcement of the robustness rules\.PRoVeFLimproves the scalability of the peer\-to\-peer approach used in Franzese et al\.\[[14](https://arxiv.org/html/2607.06612#bib.bib54)\], and its design ensures that security and performance scale with the number of servers without burdening clients with additional communication or computation\. A detailed comparison ofPRoVeFLwith existing FL schemes across key security properties is presented in Table[1](https://arxiv.org/html/2607.06612#S1.T1)\.

PRoVeFLis compatible with state\-of\-the\-art Byzantine resilient aggregation rules\. We demonstrate this by implementing Krum\[[5](https://arxiv.org/html/2607.06612#bib.bib40)\], Trimmed Mean\[[56](https://arxiv.org/html/2607.06612#bib.bib41)\], FLTrust\[[8](https://arxiv.org/html/2607.06612#bib.bib42)\]and MESAS\[[29](https://arxiv.org/html/2607.06612#bib.bib8)\]\. This is a significant improvement over existing approaches that rely solely on relaxed rules, such as norm clipping\. We also carefully choose these aggregation rules to cover complex operations such as \(coordinate\-wise\) sorting, pairwise comparison, and cosine similarity\. A central technical idea underlyingPRoVeFLis the use of a jointly generated random multiplicative maskr, which enables a carefully controlled transition from encrypted to plaintext computation without compromising privacy\. Specifically, each client encrypts its update under the group public key and homomorphically applies the encrypted maskEncp​k​\(r\)\\text\{Enc\}\_\{pk\}\(r\)to its local update sharesui​ku\_\{ik\}, yieldingEncp​k​\(r⋅ui​k\)\\text\{Enc\}\_\{pk\}\(r\\cdot u\_\{ik\}\)\. The servers then perform the necessary statistical operations to obtainEncp​k​\(r⋅si​k\)\\text\{Enc\}\_\{pk\}\(r\\cdot s\_\{ik\}\), and then collaboratively decrypt the results\. Crucially, decryption reveals only the masked intermediate values\. This allows the computationally expensive selection and filtering steps to be completed in plaintext, at a fraction of the cost of performing them homomorphically\. In summary, our main contributions are as follows:

- •Privacy and Robustness:PRoVeFLis a generic and flexible multi\-server FL framework that can integrate state\-of\-the\-art Byzantine\-robust aggregation schemes, while preserving the privacy of clients’ updates, utilizing multi\-key homomorphic encryption\.
- •Efficiency:PRoVeFLimproves efficiency and practicality by incorporating partial plaintext computation in the multi\-server setting \(by obfuscating ciphertexts to preserve order and privacy\) and significantly reducing computation and communication costs to achieve scalability\.
- •Verifiability:PRoVeFLprovides verifiability for the entire aggregation process, including the guarantee of correct execution for Byzantine\-robustness computations, with a minimal trust requirement of at least one honest server\.
- •Evaluation:We evaluatePRoVeFLin different settings, with varying numbers of parameters, participants, and servers, while using state\-of\-the\-art Byzantine\-robust aggregation rules such asL2L\_\{2\}norm, Krum, Trimmed\-Mean, and FLTrust\. The results demonstrate the practicality and efficiency ofPRoVeFL\.

Table 1:Qualitative comparison of related FL frameworks\.StudyNo\. Serv\.PropertiesThreat ModelPriv\.Robust\.Verif\.Mal\. Serv\.Mal\. ClientSeaFlame\[[47](https://arxiv.org/html/2607.06612#bib.bib48)\]2✓✓✗✓✓MUDGUARD\[[51](https://arxiv.org/html/2607.06612#bib.bib49)\]≥2\\geq 2✓✓✓✓✓SafeFL\[[20](https://arxiv.org/html/2607.06612#bib.bib50)\]≥2\\geq 2✓✓✗✓✓TAPFed\[[54](https://arxiv.org/html/2607.06612#bib.bib51)\]\>2\>2✓✗✓✓✗DefendFL\[[32](https://arxiv.org/html/2607.06612#bib.bib52)\]1✓✓✗✗✓Franzese et al\.\[[14](https://arxiv.org/html/2607.06612#bib.bib54)\]–✓✓✓✓✓ELSA\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\]2✓✓✗✓✓Ma et al\.\[[35](https://arxiv.org/html/2607.06612#bib.bib61)\]2✓✗✓✓✓ACORN\[[4](https://arxiv.org/html/2607.06612#bib.bib62)\]1✓✓✗✓✓Tang et al\.\[[48](https://arxiv.org/html/2607.06612#bib.bib63)\]2✓✓✗✓✓Eiffel\[[44](https://arxiv.org/html/2607.06612#bib.bib64)\]1✓✓✗✗✓RoFL\[[6](https://arxiv.org/html/2607.06612#bib.bib12)\]1✓✓✗✗✓Prio\[[10](https://arxiv.org/html/2607.06612#bib.bib11)\]≥2\\geq 2✓✓✗✗✓Prio\+\[[1](https://arxiv.org/html/2607.06612#bib.bib10)\]≥2\\geq 2✓✓✗✗✓PVFL\[[55](https://arxiv.org/html/2607.06612#bib.bib69)\]11✓✗✓✗✗VPPFL\[[26](https://arxiv.org/html/2607.06612#bib.bib68)\]22✓✓✓✗✓PRoVeFL≥2\\geq 2✓✓✓∗\*✓✓✓

∗\*✓✓refers to wide coverage of state\-of\-the\-art robustness measures\.

## 2Background and Related Work

In this section, we discuss the background of federated learning \(FL\) and its susceptibility to poisoning, inference, and aggregation attacks\. We also discuss the security building blocks in our framework for integrating with FL\.

### 2\.1Federated Learning

Federated Learning \(FL\) is a distributed machine learning paradigm designed to collaboratively train a shared global model across multiple clients \(e\.g\., big institutions such as healthcare or financial organizations, mobile devices or sensors\) without transferring their local datasets to a central server\[[38](https://arxiv.org/html/2607.06612#bib.bib39)\]\. This framework is particularly useful as a first line of defense in privacy\-sensitive applications, as it keeps raw data on\-premises and only allows for the movement of the locally trained model\.

Formally, considernnclients, each holding a private datasetDiD\_\{i\}\. The goal is to train a global modelu∈ℝdu\\in\\mathbb\{R\}^\{d\}that minimizes a global loss function expressed as a weighted average of local empirical losses:

minu⁡F​\(u\)=∑i=1nwi​Fi​\(u\),\\min\_\{u\}F\(u\)=\\sum\_\{i=1\}^\{n\}w\_\{i\}F\_\{i\}\(u\),whereFi​\(u\)=1\|Di\|​∑\(x,y\)∈Diℓ​\(u;x,y\)F\_\{i\}\(u\)=\\frac\{1\}\{\|D\_\{i\}\|\}\\sum\_\{\(x,y\)\\in D\_\{i\}\}\\ell\(u;x,y\)is the local loss function of clientiibased on its datasetDiD\_\{i\}, andℓ\\ellis a suitable loss function \(e\.g\., cross\-entropy or mean squared error\)\. The weightwi=\|Di\|∑j=1n\|Dj\|w\_\{i\}=\\frac\{\|D\_\{i\}\|\}\{\\sum\_\{j=1\}^\{n\}\|D\_\{j\}\|\}represents the proportion of data owned by the clientii\.

The Federated Averaging \(FedAvg\) algorithm\[[37](https://arxiv.org/html/2607.06612#bib.bib38)\]is the most widely used approach in FL\. In each communication round: \(1\) the server broadcasts the current global modelutu^\{t\}to a subset of clients; \(2\) each selected client performs local training, typically several steps of gradient descent:

uit\+1=ut−η​∇Fi​\(ut\),u\_\{i\}^\{t\+1\}=u^\{t\}\-\\eta\\nabla F\_\{i\}\(u^\{t\}\),whereη\\etais the learning rate; \(3\) clients send their locally updated modelsuit\+1u\_\{i\}^\{t\+1\}to the server; \(4\) the server aggregates them to update the global model:

ut\+1=∑i=1nwi​uit\+1\.u^\{t\+1\}=\\sum\_\{i=1\}^\{n\}w\_\{i\}u\_\{i\}^\{t\+1\}\.This process iterates until convergence\.

#### 2\.1\.1Security Threats in FL

Despite its privacy\-conscious design, FL is vulnerable to several security threats that can compromise data confidentiality, model integrity, and overall utility\. These threats are broadly categorized into poisoning, inference, and aggregation attacks\.

##### 2\.1\.1\.1Poisoning Attacks

These attacks aim to corrupt the training process by injecting malicious behavior through either data or model updates\. In data poisoning, the attacker manipulates their local datasetDiD\_\{i\}\(e\.g\., by mislabeling or crafting samples\) to influence the model’s behavior in targeted or untargeted ways\. In model poisoning, rather than altering data, the attacker directly crafts the local updateu\(i\)u^\{\(i\)\}to introduce backdoors or cause a targeted degradation of the global model\. Some of the popular state\-of\-the\-art poisoning attacks are label poisoning attack\[[45](https://arxiv.org/html/2607.06612#bib.bib29)\], backdoor attack\[[2](https://arxiv.org/html/2607.06612#bib.bib32)\], LIE attack\[[3](https://arxiv.org/html/2607.06612#bib.bib31)\], Trim Attack\[[13](https://arxiv.org/html/2607.06612#bib.bib37)\]and Shejwalkar attack\[[46](https://arxiv.org/html/2607.06612#bib.bib30)\]\.

##### 2\.1\.1\.2Inference Attacks

These attacks exploit the visibility of intermediate or final model updates to extract private information\. Membership Inference Attacks\[[40](https://arxiv.org/html/2607.06612#bib.bib3)\]determine whether a specific data point was included in a client’s training data\. Property Inference Attacks\[[17](https://arxiv.org/html/2607.06612#bib.bib27)\]reveal sensitive attributes or patterns from a client’s data \(e\.g\., presence of a disease\)\. Gradient Inversion Attacks\[[15](https://arxiv.org/html/2607.06612#bib.bib28)\]reconstruct raw training data from shared gradients, especially in settings with few clients or sparse updates\.

##### 2\.1\.1\.3Aggregation Attacks

These attacks target the aggregation mechanism itself, leading to unreliable or biased global models\[[22](https://arxiv.org/html/2607.06612#bib.bib20),[52](https://arxiv.org/html/2607.06612#bib.bib21)\]\. In traditional federated learning, the server is assumed to be honest but curious; however, this assumption may not always hold in practice\. If the central server is malicious or compromised, it can deliberately perform an incorrect aggregation of client updates, thereby compromising the integrity and utility of the global model\. A dishonest server may alter the aggregation logic, such as assigning skewed weights to specific clients, selectively dropping updates from certain clients \(e\.g\., honest ones\), or altering them before aggregation, which can lead to bias, reduced performance, or intentional misbehavior of the global model\. A compromised server may collude with a subset of adversarial clients to amplify their impact by preferentially accepting their manipulated updates\.

These vulnerabilities necessitate trustworthy Byzantine resilient aggregation in privacy\-preserving settings\.Ensuring privacy, integrity and trust in FL is crucial for its deployment in real\-world applications\.

#### 2\.1\.2Byzantine\-Robust Aggregation Schemes in FL

Byzantine\-robust aggregation schemes are designed to protect the global model from malicious client updates\. These schemes apply statistical criteria to filter, select, or reweight updates before aggregation\. Below, we describe three representative schemes that differ in their approach: Krum selects a single most\-consistent update, Trimmed Mean discards coordinate\-wise extremes, and FLTrust weights updates by their alignment with a trusted reference\. We later instantiate each of these withinPRoVeFL\(Section[4](https://arxiv.org/html/2607.06612#S4)\)\.

##### 2\.1\.2\.1Krum

Krum\[[5](https://arxiv.org/html/2607.06612#bib.bib40)\]is a Byzantine\-robust aggregation rule that selects the client update most consistent with the majority of updates\. This method is effective against up tof<n2f<\\frac\{n\}\{2\}Byzantine clients amongnntotal clients\.

Input:A set ofnnclient updates\{u1,u2,…,un\}⊂ℝd\\\{u\_\{1\},u\_\{2\},\\dots,u\_\{n\}\\\}\\subset\\mathbb\{R\}^\{d\}and a known upper boundffon the number of Byzantine clients\.

Operations:Krum performs the following operations\.

1. 1\.Pairwise distances:For each clienti∈\{1,…,n\}i\\in\\\{1,\\dots,n\\\}, compute the squared Euclidean distance to all other updates: di​j=‖ui−uj‖2,∀j≠i\.d\_\{ij\}=\\\|u\_\{i\}\-u\_\{j\}\\\|^\{2\},\\quad\\forall j\\neq i\.
2. 2\.Score computation:For eachii, sort the distancesdi​jd\_\{ij\}in ascending order and take then−f−2n\-f\-2least values\. The*Krum score*ofuiu\_\{i\}is the sum of these distances: score​\(ui\)=∑j∈𝒩idi​j,where​𝒩i⊂\{1,…,n\}∖\{i\},\\mathrm\{score\}\(u\_\{i\}\)=\\sum\_\{j\\in\\mathcal\{N\}\_\{i\}\}d\_\{ij\},\\quad\\text\{where \}\\mathcal\{N\}\_\{i\}\\subset\\\{1,\\dots,n\\\}\\setminus\\\{i\\\},\\,where\|𝒩i\|=n−f−2\.\|\\mathcal\{N\}\_\{i\}\|=n\-f\-2\.

Selection:Returnut\+1u^\{t\+1\}, the update with smallest score\.

##### 2\.1\.2\.2Trimmed Mean

Trimmed Mean\[[56](https://arxiv.org/html/2607.06612#bib.bib41)\]is a robust coordinate aggregation rule designed to tolerate up toffByzantine clients\. It operates by discarding the extreme values in each coordinate across all client updates\.

Input:A set ofnnclient updates\{u1,u2,…,un\}⊂ℝd\\\{u\_\{1\},u\_\{2\},\\dots,u\_\{n\}\\\}\\subset\\mathbb\{R\}^\{d\}and a known upper boundffon the number of Byzantine clients\.

Operations:Trimmed\-Mean does the following operations\.

1. 1\.Coordinate\-wise sorting:For each coordinatej∈\{1,…,d\}j\\in\\\{1,\\dots,d\\\}, collect thejj\-th coordinate from all updates: Vj=\{u1​\[j\],u2​\[j\],…,un​\[j\]\}\.V\_\{j\}=\\\{u\_\{1\}\[j\],u\_\{2\}\[j\],\\dots,u\_\{n\}\[j\]\\\}\.SortVjV\_\{j\}in ascending order\.
2. 2\.Trim extremes:Remove the largestffand smallestffvalues fromVjV\_\{j\}, forf<n/2f<n/2\.

Selection:Compute the mean of the remaining values:

ut\+1​\[j\]=1n−2​f​∑v∈Vjtrimmedv\.u^\{t\+1\}\[j\]=\\frac\{1\}\{n\-2f\}\\sum\_\{v\\in V\_\{j\}^\{\\text\{trimmed\}\}\}v\.This is repeated independently for each coordinatejj, yielding the aggregated update\.

##### 2\.1\.2\.3FLTrust

FLTrust\[[8](https://arxiv.org/html/2607.06612#bib.bib42)\]is a Byzantine\-robust aggregation framework that assumes servers have access to a small, trusted dataset\. It uses this dataset to both verify client updates and guide aggregation through a trust\-weighted averaging scheme\.

Input:

- •A set of client updates\{u1,u2,…,un\}⊂ℝd\\\{u\_\{1\},u\_\{2\},\\dots,u\_\{n\}\\\}\\subset\\mathbb\{R\}^\{d\},
- •A trusted updateu0u\_\{0\}computed locally by the server on a small clean dataset\.

Operations:FLTrust does the following operations\.

1. 1\.Compute trust score:For each clientii, compute trust score as the ReLU of cosine similarity between each local model update with the trusted update: wi=max⁡\{0,cos⁡\(ui,u0\)\}\.w\_\{i\}=\\max\\left\\\{0,\\cos\(u\_\{i\},u\_\{0\}\)\\right\\\}\.
2. 2\.Rescale updates:Rescale each normalized client update by its norm and trust score: uiscaled=wi⋅‖u0‖‖ui‖⋅ui\.u\_\{i\}^\{\\text\{scaled\}\}=w\_\{i\}\\cdot\\frac\{\\\|u\_\{0\}\\\|\}\{\\\|u\_\{i\}\\\|\}\\cdot u\_\{i\}\.

Aggregation:Aggregate the rescaled updates using a normalized trust\-weighted average:

ut\+1=∑i=1nuiscaled∑i=1nwi\.u^\{t\+1\}=\\frac\{\\sum\_\{i=1\}^\{n\}u\_\{i\}^\{\\text\{scaled\}\}\}\{\\sum\_\{i=1\}^\{n\}w\_\{i\}\}\.

#### 2\.1\.3Related Work on FL Security

Secure and Robust Federated Learning \(SRFL\) under a dual\-server architecture aims to achieve privacy and robustness by separating aggregation and validation roles across two non colluding servers\[[33](https://arxiv.org/html/2607.06612#bib.bib5)\]\. SRFL employs CKKS encryption, random perturbation, and encrypted similarity\-based verification models to filter poisoned updates\. However, it is not extensible to other Byzantine\-robust aggregation algorithms, nor does it provide cryptographic guarantees for the correctness of server\-side aggregation\. Usingℓ2\\ell\_\{2\}norm\-bounding, ELSA proposes a safe aggregation method based on a dual\-server model to guarantee privacy and strong gradient filtering to achieve Byzantine robustness\[[20](https://arxiv.org/html/2607.06612#bib.bib50)\]\. SeaFlame builds upon ELSA by reducing communication costs while maintaining privacy and robustness against gradient boosting\[[47](https://arxiv.org/html/2607.06612#bib.bib48)\]\. TAPFed employs threshold cryptography for resilience to dropouts and also serves as built\-in verification, since it can tolerate some aggregators being malicious; as long as the number of honest parties exceeds a given threshold, the correct global model can be reconstructed by the clients\[[54](https://arxiv.org/html/2607.06612#bib.bib51)\]\. However, it does not provide a Byzantine\-robust aggregation for client updates\. RoFL\[[6](https://arxiv.org/html/2607.06612#bib.bib12)\], Prio\[[10](https://arxiv.org/html/2607.06612#bib.bib11)\], and Prio\+\[[1](https://arxiv.org/html/2607.06612#bib.bib10)\]ensure Byzantine robustness through lightweight aggregation proofs but are not built for security against adversarial servers\. SMPC\-based secure aggregation is incorporated into SafeFL to ensure secure aggregation, but instead of providing server computations, it provides a guarantee that a single malicious server cannot corrupt the computation if there is at least one honest server\[[20](https://arxiv.org/html/2607.06612#bib.bib50)\]\.

MUDGUARD\[[51](https://arxiv.org/html/2607.06612#bib.bib49)\]and Franzese et al\.\[[14](https://arxiv.org/html/2607.06612#bib.bib54)\]represent state\-of\-the\-art frameworks to holistically address the key challenges mentioned above\. MUDGUARD guarantees these properties for the malicious minority on servers and for the malicious majority on clients\. However, it lacks support for verifying client\-side robustness enforcement on the server\.PRoVeFLimproves on MUDGUARD by introducing a verifiability mechanism that enables clients to verify the correctness of the server’s Byzantine\-robust enforcement of the aggregated model\. Franzese et al\. proposed a fully decentralised framework that is based on SMPC, which is a flexible and theoretically sound approach, but it has limited practical deployment for large\-scale FL tasks\.

The proposed protocolPRoVeFLaddresses these shortcomings by introducing a privacy\-preserving, verifiable, and secure aggregation framework\. The system operates under a distributed\-trust model with multiple servers, assuming that only one must be honest, and is designed to scale efficiently as the number of servers increases\. Table[1](https://arxiv.org/html/2607.06612#S1.T1)presents a comparative analysis of key FL frameworks across privacy, robustness, verifiability, and threat model\. While most prior work satisfies one or two of these properties, onlyPRoVeFLoffers comprehensive coverage\. It is the only framework that guarantees client update privacy, Byzantine\-robust aggregation, and full server\-side verifiability with a minimal trust assumption and support for modern robustness measures\.

### 2\.2Multi\-Key Fully Homomorphic Encryption

Standard single\-key Fully Homomorphic Encryption \(FHE\) suffices when all data is encrypted under a single public key by a single client\. However, this is not sufficient for federated aggregation, which involves*independent*clients\. Multi\-Key FHE \(MK\-FHE\) addresses this point by deriving a joint public key and joint relinearisation key from individual key shares, enabling homomorphic evaluation across ciphertexts encrypted by multiple parties while ensuring that no single party ever learns the collective secret\[[34](https://arxiv.org/html/2607.06612#bib.bib24),[12](https://arxiv.org/html/2607.06612#bib.bib25)\]\. The construction below follows the Ring\-LWE instantiation used for our protocol\.

LetNNbe a power\-of\-two cyclotomic dimension withq∈ℤq\\in\\mathbb\{Z\}the ciphertext modulus, andRq=ℤq​\[x\]/\(xN\+1\)R\_\{q\}=\\mathbb\{Z\}\_\{q\}\[x\]/\(x^\{N\}\+1\)\. Assumennparties \(aggregation servers in our protocol\) are𝒮1,…,𝒮n\\mathcal\{S\}\_\{1\},\\dots,\\mathcal\{S\}\_\{n\}\.

\(1\) Individual secrets\. Each party draws a small secret polynomialsk​←$​χ⊂Rqs\_\{k\}\\overset\{\\mathdollar\}\{\\leftarrow\}\\chi\\subset R\_\{q\}and publishes a common randoma∈Rqa\\in R\_\{q\}\.

\(2\) Collective public key\. Each party samples an errorek←χe\_\{k\}\\leftarrow\\chiand broadcastsbk:=−a​sk\+ekb\_\{k\}:=\-as\_\{k\}\+e\_\{k\}\. The*group public key*is

pk=\(b,a\),b:=∑k=1nbk=−a​∑k=1nsk⏟S\+e,e=∑kek,\\textsf\{pk\}=\\bigl\(b,\\;a\\bigr\),\\quad b:=\\sum\_\{k=1\}^\{n\}b\_\{k\}=\-a\\\!\\underbrace\{\\textstyle\\sum\_\{k=1\}^\{n\}s\_\{k\}\}\_\{S\}\+\\;e,\\;\\;e=\\sum\_\{k\}e\_\{k\},where the implicit*group secret key*S=∑kskS=\\sum\_\{k\}s\_\{k\}is*never*reconstructed\.

\(3\) Collective relinearisation key\.

- •Each server𝒮k\\mathcal\{S\}\_\{k\}forms two plaintextsαk=sk2\\alpha\_\{k\}=s\_\{k\}^\{2\}andβk=2​sk\\beta\_\{k\}=2s\_\{k\}, then encrypts them under the group public key: ctα,k=Encpk⁡\(αk\),ctβ,k=Encpk⁡\(βk\)\.\\textsf\{ct\}\_\{\\alpha,k\}=\\operatorname\{Enc\}\_\{\\textsf\{pk\}\}\(\\alpha\_\{k\}\),\\qquad\\textsf\{ct\}\_\{\\beta,k\}=\\operatorname\{Enc\}\_\{\\textsf\{pk\}\}\(\\beta\_\{k\}\)\.
- •The ciphertexts are broadcast and homomorphically added to compute: rlk=Encpk⁡\(S2\)\\textsf\{rlk\}=\\operatorname\{Enc\}\_\{\\textsf\{pk\}\}\\\!\\bigl\(S^\{2\}\\bigr\)whereS=∑k=1nskS=\\sum\_\{k=1\}^\{n\}s\_\{k\}is the \(implicit\) group secret\.

The valuerlkis the*group relinearisation key*, enabling efficient ciphertext–ciphertext multiplication while revealing no individual secret key material\.

\(4\) Encryption\. Anyone can encryptm∈Rqm\\in R\_\{q\}via

Encpk⁡\(m\):u←χ,e1,e2←χ,\\operatorname\{Enc\}\_\{\\textsf\{pk\}\}\(m\):\\;u\\leftarrow\\chi,\\;e\_\{1\},e\_\{2\}\\leftarrow\\chi,\(c0,c1\)=\(b​u\+e1\+m,a​u\+e2\)\.\(c\_\{0\},c\_\{1\}\)=\(bu\+e\_\{1\}\+m,\\;au\+e\_\{2\}\)\.
\(5\) Homomorphic operations\. Addition is component\-wise\. Multiplication usesrlk:\(c0,c1\)∗\(d0,d1\)→rlk\(c~0,c~1\)\(c\_\{0\},c\_\{1\}\)\\\!\\ast\\\!\(d\_\{0\},d\_\{1\}\)\\xrightarrow\{\\textsf\{rlk\}\}\(\\tilde\{c\}\_\{0\},\\tilde\{c\}\_\{1\}\)\.

\(6\) Threshold decryption\. Each server outputs a*partial decryption*dk=sk​c1d\_\{k\}=s\_\{k\}c\_\{1\}\. Aggregating yields

m=c0\+∑k=1ndk\(modq\),m=c\_\{0\}\+\\sum\_\{k=1\}^\{n\}d\_\{k\}\\pmod\{q\},so*all*servers must cooperate; a single honest party can block decryption and thus prevents data leakage to colluding adversaries\.

Security Building Blocks\.The confidentiality and correctness of homomorphic evaluation rely on the*decisional Ring–LWE*assumption, the standard hardness foundation for lattice\-based fully homomorphic encryption \(BGV/CKKS\)\.

#### 2\.2\.1The Decisional Ring‑LWE Problem\.

LetNNbe a power of two;qqa prime withq≡1\(mod2​N\)q\\equiv 1\\pmod\{2N\}; andRq=ℤq​\[x\]/\(xN\+1\)R\_\{q\}=\\mathbb\{Z\}\_\{q\}\[x\]/\(x^\{N\}\+1\)the degree‑NNcyclotomic ring\. Fix a noise distributionχ\\chioverRqR\_\{q\}\(e\.g\., a centered binomial or discrete Gaussian\) with small standard deviation\. For a secrets​←$​χs\\overset\{\\mathdollar\}\{\\leftarrow\}\\chiand independently sampleda​←$​Rqa\\overset\{\\mathdollar\}\{\\leftarrow\}R\_\{q\},e​←$​χe\\overset\{\\mathdollar\}\{\\leftarrow\}\\chi, an*RLWE sample*is the pair

\(a,b=a⋅s\+e\)∈Rq×Rq\.\(a,\\;b=a\\cdot s\+e\)\\;\\in\\;R\_\{q\}\\times R\_\{q\}\.The*decisional RLWE*problem asks to distinguish polynomially many independent RLWE samples from uniformly random pairs inRq×RqR\_\{q\}\\times R\_\{q\}\. Formally, the advantage of a probabilistic polynomial‑time distinguisher𝒟\\mathcal\{D\}is,

Adv𝒟RLWE=\\displaystyle\\mathrm\{Adv\}\_\{\\mathcal\{D\}\}^\{\\mathrm\{RLWE\}\}=\{\}\|Pr\[𝒟\(a,b\)=1∣b=a⋅s\+e\]\\displaystyle\\left\|\\Pr\[\\mathcal\{D\}\(a,b\)=1\\mid b=a\\cdot s\+e\]\\right\.−Pr\[𝒟\(a,u\)=1∣u←$Rq\]\|\\displaystyle\\qquad\\left\.\-\\Pr\[\\mathcal\{D\}\(a,u\)=1\\mid u\\overset\{\\mathdollar\}\{\\leftarrow\}R\_\{q\}\]\\right\|
The*Decisional RLWE Assumption*states that for any PPT𝒟\\mathcal\{D\}this advantage is negligible in the security parameter\.

### 2\.3Verifiability of Arithmetic Computations

#### 2\.3\.1Commitment\-based verification

To enable public verification of basic arithmetic on committed values, each client publishes discrete logarithmic commitments to their data\. Suppose a client sends plaintext valuesx,y∈ℤpx,y\\in\\mathbb\{Z\}\_\{p\}to the server, along with corresponding commitments:

h1=gx,h2=gy,h\_\{1\}=g^\{x\},\\qquad h\_\{2\}=g^\{y\},whereggis a generator of a cyclic group𝔾\\mathbb\{G\}of prime orderpp\. It satisfies the following properties:

Addition \(a=x\+ya=x\+y\)\.The server computesa=x\+ya=x\+y\. Any verifier can confirm the result using the group law:

ga=?h1⋅h2\.g^\{a\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}h\_\{1\}\\cdot h\_\{2\}\.
Multiplication \(b=x⋅yb=x\\cdot y\)\.The server computesb=x⋅yb=x\\cdot y\. Verification is done via a bilinear pairinge:𝔾×𝔾→𝔾Te:\\mathbb\{G\}\\times\\mathbb\{G\}\\to\\mathbb\{G\}\_\{T\}:

e​\(g,g\)b=?e​\(h1,h2\)\.e\(g,g\)^\{b\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}e\(h\_\{1\},h\_\{2\}\)\.
Security Building Blocks\.Soundness of the server\-side verification mechanism is guaranteed by the intractability of the*Discrete Logarithm Problem*in a prime\-order group, which underlies the exponentiation commitments attached to every model coordinate\.

#### 2\.3\.2Discrete Logarithm Problem \(DLP\)

For the commitments,hj=gui,jh\_\{j\}=g^\{u\_\{i,j\}\}works in a cyclic prime order group\(𝔾,⋅\)\(\\mathbb\{G\},\\cdot\)with the generatorgg\. Given\(g,gx\)\(g,\\,g^\{x\}\), an adversary’s task is to recoverxx\. The*Discrete Logarithm Problem*asserts that this inversion is infeasible for any PPT algorithm when the group order is sufficiently large \(e\.g\., a 256\-bit prime\)\. The integrity of verification, therefore, reduces to DLP hardness\.

In summary, the confidentiality of the ciphertexts is based on decisional RingLWE, while the extractibility of the commitments and the integrity of the server computations are based on DLP\. These assumptions are standard and widely deployed, providing strong confidence in the cryptographic foundations of our framework\.

## 3Problem Overview

We consider a federated learning \(FL\) framework comprisingnnclients andmmservers, withn≫m≥2n\\gg m\\geq 2\.

Client Role\.Each client performs local training on its dataset and generates a model update vectoruiu\_\{i\}\. To preserve privacy, the client encrypts its update using a multi\-key fully homomorphic encryption \(MK\-FHE\) scheme \(with decryption keys shared among servers\), yielding a ciphertextEnc𝗉𝗄⁡\(ui\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{i\}\\right\)that supports computations over it\.

Server Role\.Each serverk∈\{1,2,…,m\}k\\in\\\{1,2,\\ldots,m\\\}is responsible for performing secure aggregation over the encrypted shares\. By leveraging homomorphic properties of MK\-FHE, servers can jointly compute statistical functions \(e\.g\., sum, average, norm\) over ciphertexts without decrypting them\.

### 3\.1Threat Assumptions

We consider a malicious threat model in which both servers and clients may adversarially deviate from the protocol to compromise privacy or correctness\. The system consists of multiple clients \(e\.g\., healthcare and financial institutions\) and two \(or more\) coordinating servers for managing the FL process\. Each client maintains a private dataset and periodically submits local model updates\.Any subset of clients may also be malicious, which can submit poisoned or arbitrarily crafted local updates to bias or degrade the global model or attempt to extract information about an honest client’s updates by colluding with the malicious server or by analysing the change in successive global models\.

The protocol assumes thatat least one of the servers is honest, while other servers may even collude and \(1\) attempt to learn individual client updates by deviating from the protocol or observing data flows, \(2\) manipulate the global aggregation process by selectively dropping or altering updates, or \(3\) send incorrect global models back to the clients, potentially disrupting model convergence\.

If a malicious server ignores all updates or selectively drops certain client updates, the protocol might fail to produce a global model\. The protocol must detect such behaviour and prevent the malicious server from gaining information by observing which updates are included\.

#### 3\.1\.1Security Guarantees

Our proposed framework offers the following security guarantees:

1. 1\.Privacy of client updates:Clients’ local model updates remain protected throughout the training process\. It ensures that even if a subset of clients or servers is compromised, the confidentiality of client data is preserved\.
2. 2\.Integrity of client updates:Ensuring that the system can detect and tolerate poisoned updates received from the malicious clients\.
3. 3\.Integrity of Aggregation:The aggregation process is verifiable and resistant to tampering, ensuring that the final model reflects genuine client contributions\.
4. 4\.Scalability and Efficiency:By distributing computational tasks and transitioning certain operations to the plaintext domain when secure to do so, the framework achieves practical efficiency suitable for large\-scale deployments\.

## 4Our proposed framework:PRoVeFL

This section presents ourPrivate,Robust, andVerifiableFL\(PRoVeFL\) framework\. Since each Byzantine\-robust aggregation scheme makes different assumptions about malicious settings and employs unique approaches, we demonstratePRoVeFLusing state\-of\-the\-art poisoning\-resistant algorithms such as Krum, Trimmed\-Mean, FLTrust, and discuss its extendability to MESAS, CrowdGuard, and FLAME\. We intentionally selected these algorithms because they cover various types of operations, including statistical operations, client\-provided private input, and server\-provided public input\.

![Refer to caption](https://arxiv.org/html/2607.06612v1/provefl.png)Figure 1:Our Proposed Framework### 4\.1System Model and Notation

We use the following notation throughout this section\. Letnndenote the number of clients andffthe upper bound on Byzantine \(malicious\) clients\. Each clienti∈\{1,…,n\}i\\in\\\{1,\\dots,n\\\}holds a local model update vectorui∈ℝNu\_\{i\}\\in\\mathbb\{R\}^\{N\}, computed as the gradient∇ℒi\\nabla\\mathcal\{L\}\_\{i\}of a local loss function\. Letmmdenote the number of servers\. The vector is deterministically split intommequal\-length parts:ui=\(ui,1​‖ui,2‖​…∥ui,m\)u\_\{i\}=\(u\_\{i,1\}\\,\\\|\\,u\_\{i,2\}\\,\\\|\\,\\dots\\,\\\|\\,u\_\{i,m\}\), withui,k∈ℝN/mu\_\{i,k\}\\in\\mathbb\{R\}^\{N/m\}fork∈\{1,2,…,m\}k\\in\\\{1,2,\\dots,m\\\}\.Enc𝗉𝗄⁡\(x\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(x\)denotes the encryption ofxxwith the public keyp​kpkwhere the public key is generated as described in Section[2\.2](https://arxiv.org/html/2607.06612#S2.SS2)\.

Server\-held ciphertexts are denotedci,kc\_\{i,k\}, representing thekthk^\{\\text\{th\}\}share of the encrypted update vector for clientiiheld with Server\-kk\. For schemes such as FLTrust, the trusted server model update is denotedu0u\_\{0\}with norm‖u0‖\\\|u\_\{0\}\\\|, and the trust score for clientiiis denotedwiw\_\{i\}\. Final aggregation steps produce the next\-round global model updateut\+1u^\{t\+1\}\. All cryptographic operations assume cyclic group𝔾\\mathbb\{G\}of prime orderpp, with associated bilinear mape:𝔾×𝔾→𝔾Te:\\mathbb\{G\}\\times\\mathbb\{G\}\\rightarrow\\mathbb\{G\}\_\{T\}\.

Figure[1](https://arxiv.org/html/2607.06612#S4.F1)demonstratesPRoVeFLconsidering the example of two servers and three clients\. Details of the framework are described below\.

### 4\.2Protocol Workflow

PRoVeFLproceeds in three stages: generation of published parameters, client\-side and server\-side operations\. For ease of readability, we consider only two servers to describe the protocol, but it can be extended to any fixed number of servers\. We first explain how the two servers jointly derive the global random mask and commitment generator; this protocol is summarized in Figure[2](https://arxiv.org/html/2607.06612#S4.F2)\. We then present the*generic*encrypted aggregation pipeline, covering client uploads, server\-side homomorphic processing, collaborative decryption, public verification, and aggregation, as shown in Figure[3](https://arxiv.org/html/2607.06612#S4.F3)\. Finally, we instantiate the “method\-specific” block of that pipeline with three state\-of\-the\-art defenses: Krum \(Figure[4](https://arxiv.org/html/2607.06612#S4.F4)\), Trimmed\-Mean \(Figure[5](https://arxiv.org/html/2607.06612#S4.F5)\), and FLTrust \(Figure[6](https://arxiv.org/html/2607.06612#S4.F6)\)\. It demonstrates that a single set of cryptographic building blocks underlies all three Byzantine\-robust aggregation schemes while accommodating their distinct statistical logics\.

Generation of Published ParametersSetup:Fix a public generatorg0∈𝔾g\_\{0\}\\in\\mathbb\{G\}of prime orderppand the joint FHE public key𝗉𝗄\\mathsf\{pk\}\.Step 1: Local randomness\.rk​←$​ℤp​by each server​𝒦\.r\_\{k\}\\overset\{\\mathdollar\}\{\\leftarrow\}\\mathbb\{Z\}\_\{p\}\\quad\\text\{by each server \}\\mathcal\{K\}\.Step 2: Share publication\.ck=Enc𝗉𝗄⁡\(rk\),gk=g0rkmodp\.c\_\{k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\_\{k\}\),\\qquad g\_\{k\}=g\_\{0\}^\{r\_\{k\}\}\\bmod p\.Step 3: Homomorphic aggregation\.Enc𝗉𝗄⁡\(r\)=c1\+c2,r=r1\+r2modp\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\)=c\_\{1\}\+c\_\{2\},\\quad r=r\_\{1\}\+r\_\{2\}\\bmod p\.Step 4: Commitment generator\.g=g1⋅g2=g0r1\+r2=g0r\(modp\)\.g=g\_\{1\}\\cdot g\_\{2\}=g\_\{0\}^\{r\_\{1\}\+r\_\{2\}\}=g\_\{0\}^\{r\}\\pmod\{p\}\.Published information:•Ciphertext of the global mask:Enc𝗉𝗄⁡\(r\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\)\.•Commitment generator:g=g0rmodpg=g\_\{0\}^\{r\}\\bmod p\.

Figure 2:Distributed Generation of Mask and Commitment Generator \(described for 2 Servers\)Published Information:•FHE Encryption of Random Maskrr:Enc𝗉𝗄⁡\(r\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\)•Commitment Generator:g=g0rmodpg=g\_\{0\}^\{r\}\\mod pClient Side Operations:Each client performs the six deterministic steps•Gradient Computation: The client computes its local model updateui←∇ℒiu\_\{i\}\\leftarrow\\nabla\\mathcal\{L\}\_\{i\}\.•Deterministic Split: The update vector is split into equal halves \(assuming 2 servers\)ui=\(ui,1∥ui,2\)∈ℝN,with​ui,1,ui,2∈ℝN/2,u\_\{i\}=\(u\_\{i,1\}\\,\\\|\\,u\_\{i,2\}\)\\in\\mathbb\{R\}^\{N\},\\quad\\text\{with \}u\_\{i,1\},u\_\{i,2\}\\in\\mathbb\{R\}^\{N/2\},\\;•FHE encryption of split\-updates: fork=1,2k=1,2,ci,k=ui,k\.Enc𝗉𝗄⁡\(r\)=Enc𝗉𝗄⁡\(r⋅ui,k\)c\_\{i,k\}=u\_\{i,k\}\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\cdot u\_\{i,k\}\)\.•FHE Encryption of norm \(Only for FLTrust\)ei,k=Enc𝗉𝗄⁡\(r‖ui,k‖\)e\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\\frac\{r\}\{\\\|u\_\{i,k\}\\\|\}\\right\)\[Note \- It can also be calculated privately at the server side\.\]•Commitment Generation:hi,kl=gui,klmodp,for​k=1,2​and​l=1,2,…​Nh\_\{i,k\_\{l\}\}=g^\{u\_\{i,k\_\{l\}\}\}\\bmod p,~\\text\{for \}k=1,2\\text\{ and \}l=1,2,\\dots N\.•Transmission: The client sends its encrypted split updates to the respective servers and publishes committed data to everyone\.Server Side Encrypted Operations:1\.Method\-Specific Encrypted Aggregation: the servers invoke one of the sub\-routines in any Byzantine\-robust aggregation scheme\.2\.Collaborative Decryption: The results are decrypted by collecting partial decryption keys from all servers\.3\.Verification of Correct Encrypted Aggregation:\(a\)The method described in Section[2\.3](https://arxiv.org/html/2607.06612#S2.SS3)is invoked by another server to verify the correctness of aggregation\.\(b\)The honest servers abort if the verification fails at this moment\.Server Side Plaintext Operations:4\.If verification succeeds, join the aggregated split updates and compute the final trust score\.5\.Selection: This step is computed in the same way as in plaintext, similar to the weighted averaging adopted in any Byzantine\-robust algorithm\.

Figure 3:PRoVeFLWorking Mechanism\.#### 4\.2\.1Initialisation

To obscure structural patterns in encrypted client updates and defend against inference attacks, all servers collaboratively generate an encrypted random multiplierEnc𝗉𝗄⁡\(r\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\right\)\(Figure[2](https://arxiv.org/html/2607.06612#S4.F2)\) by jointly contributing secret shares, ensuring that the plaintextrrremains unknown to any single party\. Each client homomorphically appliesEnc𝗉𝗄⁡\(r\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\right\)to its local updateEnc𝗉𝗄⁡\(ui​k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{ik\}\\right\), yielding randomized ciphertextsEnc𝗉𝗄⁡\(r⋅ui​k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{ik\}\\right\)\. This randomized masking step ensures that encrypted updates are obfuscated by an independently sampled multiplier, effectively breaking any consistent statistical correlation with the original plaintexts\. As the random factor changes across rounds and remains secret, adversaries cannot accumulate sufficient information to reverse engineer individual updates or inter\-client relations\.

#### 4\.2\.2Privacy\-preserving aggregation

Each server receives a distinct subset of these encrypted masked updates and independently performs the encrypted operations in any method\-specific aggregation scheme, resulting in ciphertextsEnc𝗉𝗄⁡\(r⋅si​k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot s\_\{ik\}\\right\), wheresi​ks\_\{ik\}is the plaintext value of the applied statistical operation\. These are then jointly decrypted using threshold decryption, revealing only the obfuscated valuesr⋅si​kr\\cdot s\_\{ik\}\. This relies on the fact thatrris unknown and freshly sampled each round, as discussed above\.

#### 4\.2\.3Verification

Verification follows the commitment\-based framework described in Section[2\.3](https://arxiv.org/html/2607.06612#S2.SS3)\. Each aggregation primitive produces a publicly verifiable proof\. The peer server verifies these proofs by checking, for every coordinateℓ\\ell, that the pairing or group relation holds, e\.g\.,gdi,ℓ=?hi,ℓg^\{d\_\{i,\\ell\}\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}h\_\{i,\\ell\}\(or the corresponding additive check for a method\) holds\. If*any*check fails, then the honest server refuses to release its decrypted share, causing the protocol to abort and thus prevent malformed aggregation\.

#### 4\.2\.4Collaborative decryption

Provided that all verifications succeed, the servers send the decrypted shares \(of intermediate calculations\), and concatenate to reconstitute each full score vector\. The masked plaintext aggregates are then processed exactly as in their classical counterparts: Krum selects the vector with the minimal score, Trimmed\-Mean discards extreme coordinates and averages the remainder, while FLTrust computes cosine\-similarity weightswiw\_\{i\}and outputs the normalised weighted average\. These final operations involve only inexpensive plaintext arithmetic \(minimal ciphertext arithmetic\) and therefore add negligible overhead compared with the encrypted phase\.

#### 4\.2\.5Strengthened Security Model

The proposed framework operates under a strengthened security model enabled by MK\-FHE under a distributed multi\-server architecture, which collectively provides strong guarantees of confidentiality and correctness\. A critical security concern in this setting is the possibility of collusion between malicious clients and a compromised server: since clients know their own updatesuiu\_\{i\}, a colluding client\-server pair observing the masked valuer⋅uir\\cdot u\_\{i\}could recover the global maskrrby simple division, subsequently unmasking all other honest clients’ intermediate statistics\.PRoVeFLaddresses this through an additive blinding mechanism inspired by the order\-preserving encryption scheme of Dyer et al\.\[[11](https://arxiv.org/html/2607.06612#bib.bib2)\], wherein each intermediate masked statistic is additively blinded by an independently sampledδi←$\{0,…,B−1\}\\delta\_\{i\}\\xleftarrow\{\\mathdollar\}\\\{0,\\ldots,B\-1\\\}\. The boundBBis chosen to satisfy two constraints simultaneously:B<r⋅ϵ/2B<r\\cdot\\epsilon/2to ensure ordering is preserved across distinct client updates, andB\>2λB\>2^\{\\lambda\}to ensure brute\-force recovery ofrris computationally infeasible\. These constraints are jointly satisfiable by choosingr\>2λ\+1/ϵr\>2^\{\\lambda\+1\}/\\epsilon, which is achievable within standard cryptographic group sizes, and guarantee both the correctness of ordering\-dependent aggregation rules and security against mask recovery by any coalition of colluding clients and servers\.

### 4\.3Core Aggregation Primitives

Rather than a collection of independent protocol instantiations,PRoVeFLis a general framework for privacy\-preserving Byzantine\-robust aggregation\. The framework supports a number of cryptographically\-verifiable aggregation patterns that enable many existing schemes to be supported directly\. Each primitive operates on a collection of masked, encrypted values, and produces outputs that can be verified before their use in subsequent aggregation steps\. The core primitives are as follows:

#### 4\.3\.1Linear aggregation \(LA\)

Many robust aggregation methods involve linear operations on client updates, i\.e\., addition, subtraction, \(weighted\) averaging, and norm computation\. These can be handled in an encrypted space: given the encrypted client updatesEncp​k​\(r⋅ui\)\{\\text\{Enc\}\_\{pk\}\(r\\cdot u\_\{i\}\)\}, the servers can evaluate expressions of the form∑iαi​ui\\sum\_\{i\}\\alpha\_\{i\}u\_\{i\}homomorphically, where the parametersαi\\alpha\_\{i\}may be fixed constants, or public values derived elsewhere within the aggregation process\.

#### 4\.3\.2Pairwise statistical evaluation \(PSE\)

Many Byzantine\-robust aggregation rules are based on examining all pairwise relationships between client updates, expressed as \(low\-degree\) polynomial functions on pairs of values\. This captures \(squared\) Euclidean distance, inner products, cosine similarity and other coordinate\-wise differences\.

For two encrypted updatesuiu\_\{i\}anduju\_\{j\}, servers compute encrypted statistics of the form

Encp​k​\(rc⋅f​\(ui,uj\)\),\\text\{Enc\}\_\{pk\}\(r^\{c\}\\cdot f\(u\_\{i\},u\_\{j\}\)\),wheref​\(⋅\)f\(\\cdot\)is the low\-degree polynomial function andcccaptures the degree of the operation\. Higher\-order statistics can also be handled \(e\.g\., considering all triples of values\), but are not popular in practice due to the higher costs \(cubic or worse in the number of clients\)\.

#### 4\.3\.3Secure comparison and ordering \(SCO\)

A common pattern in robust aggregation is to consider values in sorted order or to find a value\.

PRoVeFLallows secure comparison via computing masked values, which can then be collaboratively decrypted to support order\-preserving statistics\. Given two valuesxxandyy, servers can obtain only the masked differencer​\(x−y\)r\(x\-y\), which reveals the sign of\(x−y\)\(x\-y\)while obscuring the underlying values\. This also enables more complex patterns, such as coordinate\-wise sorting via compare\-and\-swap\.

#### 4\.3\.4Selection and Filtering \(SF\)

The ability to compare and sort also enables various trimming and pruning rules based on top\-kkor bottom\-kk\. After the required statistics have been computed and verified,PRoVeFLperforms selection in the plaintext domain using only masked intermediate values\. Since the random mask preserves the relative ordering, the selection and filtering decisions match those applied to the original plaintext values\.

### 4\.4Instantiation of Byzantine\-Robust Aggregation Schemes

Any aggregation scheme can be implemented withinPRoVeFLif it can be expressed in terms of a bounded number of applications of the above primitives \(LA\-linear aggregation, PSE\-pairwise statistical evaluation, SCO\-secure comparison and ordering, SF\-selection and filtering\)\. To exhibit its utility, we apply this principle to the design of three state\-of\-the\-art Byzantine\-robust algorithms inPRoVeFL: Krum\[[5](https://arxiv.org/html/2607.06612#bib.bib40)\], Trimmed\-Mean\[[56](https://arxiv.org/html/2607.06612#bib.bib41)\], FLTrust\[[8](https://arxiv.org/html/2607.06612#bib.bib42)\], and MESAS\[[29](https://arxiv.org/html/2607.06612#bib.bib8)\]defined in Section[2\.1\.2](https://arxiv.org/html/2607.06612#S2.SS1.SSS2)\.

Input:Each serverkkreceives a set ofnnencrypted client updates\{ci,k=Enc𝗉𝗄⁡\(r⋅ui,k\):i=1,2,…,n\}\\\{c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{i,k\}\\right\):i=1,2,\\dots,n\\\}, whereui,ku\_\{i,k\}iskt​hk^\{th\}subset of client update of clienti\.Server\-Side Encrypted Operations1\.For every ordered pair\(i,j\)\(i,j\)the servers computeEnc𝗉𝗄⁡\(di​jk\)=\(ci,k−cj,k\)2,∀j≠i\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(d\_\{ij\_\{k\}\}\\right\)=\(c\_\{i,k\}\-c\_\{j,k\}\)^\{2\},\\forall j\\neq i\.Note that,Enc𝗉𝗄⁡\(di​jk\)=Enc𝗉𝗄⁡\(\(r⋅xi,k−r⋅xj,k\)2\)\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(d\_\{ij\_\{k\}\}\\right\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\(r\\cdot x\_\{i,k\}\-r\\cdot x\_\{j,k\}\)^\{2\}\\right\)\.2\.Collaborative decryption\.Decrypt to obtaindi​jk=\(r⋅\(xi,k−xj,k\)\)2\.d\_\{ij\_\{k\}\}=\(r\\cdot\(x\_\{i,k\}\-x\_\{j,k\}\)\)^\{2\}\.Verification of Correct Computation\.3\.Servers publishe​\(g0,g0\)di​j,kle\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{l\}\}\}as a proof for the correct computation\.4\.Peer Servers: For every coordinateℓ\\elland pair\(i,j\)\(i,j\)verify,e​\(hi​kℓ​\(hj​kℓ\)−1,hi​kℓ​\(hj​kℓ\)−1\)=?e​\(g0,g0\)di​j,kl\.e\(h\_\{ik\_\{\\ell\}\}\(h\_\{jk\_\{\\ell\}\}\)^\{\-1\},h\_\{ik\_\{\\ell\}\}\(h\_\{jk\_\{\\ell\}\}\)^\{\-1\}\)\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}e\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{l\}\}\}\.Plaintext operations5\.Pairwise distances:Now, any of the servers \(assuming at least one is honest\) compute the pairwise distance with all decrypteddi​jkd\_\{ij\_\{k\}\}\. The distances are scaled up byrr\. However, they preserve order, which is sufficient for Krum\.6\.Score computation:This step is computed as if with plaintext, as the sum ofn−f−2n\-f\-2distances, for each client\.7\.Selection:This step can be computed in the same way as in plaintext, selecting the client update with the smallest score, as the next global model update\.

Figure 4:Instantiation of Krum inPRoVeFL#### 4\.4\.1PRoVeFL\-enabled KRUM \(Figure[4](https://arxiv.org/html/2607.06612#S4.F4)\)

Each aggregation serverkkreceives a masked shareci,k=Enc𝗉𝗄⁡\(r⋅ui,k\)c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\cdot u\_\{i,k\}\)for every clientii\. For every ordered pair\(i,j\)\(i,j\), it homomorphically computes the encrypted squared Euclidean distance of the corresponding halves via PSE,

Enc𝗉𝗄⁡\(di​j,k\)=\(ci,k−cj,k\)2\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\\!\\bigl\(d\_\{ij,k\}\\bigr\)=\\bigl\(c\_\{i,k\}\-c\_\{j,k\}\\bigr\)^\{2\}\.Collaborative decryption exposes only the obfuscated valuedi​j,k=r2​\(ui,k−uj,k\)2d\_\{ij,k\}=r^\{2\}\(u\_\{i,k\}\-u\_\{j,k\}\)^\{2\}, after which serverkkbroadcasts a pairing commitmente​\(g0,g0\)di​j,kℓe\(g\_\{0\},g\_\{0\}\)^\{\\,d\_\{ij,k\_\{\\ell\}\}\}for every coordinateℓ\\ell\.

LetΔi​j,kℓ=ui,kℓ−uj,kℓ\\Delta\_\{ij,k\_\{\\ell\}\}=u\_\{i,k\_\{\\ell\}\}\-u\_\{j,k\_\{\\ell\}\}and recall that the commitment for a single coordinate ishi,kℓ=gui,kℓ=g0r⋅ui,kℓh\_\{i,k\_\{\\ell\}\}=g^\{u\_\{i,k\_\{\\ell\}\}\}=g\_\{0\}^\{r\\cdot u\_\{i,k\_\{\\ell\}\}\}\. Using bilinearity of the pairinge​\(⋅,⋅\)e\(\\cdot,\\cdot\)we obtain

e​\(hi,kℓ​hj,kℓ−1,hi,kℓ​hj,kℓ−1\)\\displaystyle e\\bigl\(h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\},\\;h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\}\\bigr\)=e​\(gΔi​j,kℓ,gΔi​j,kℓ\)\\displaystyle=e\\bigl\(g^\{\\Delta\_\{ij,k\_\{\\ell\}\}\},\\;g^\{\\Delta\_\{ij,k\_\{\\ell\}\}\}\\bigr\)\(substituting​hx,kℓ=gux,kℓ​\)\\displaystyle\\hskip 10\.00002pt\\text\{\\small\(substituting \}h\_\{x,k\_\{\\ell\}\}=g^\{u\_\{x,k\_\{\\ell\}\}\}\\text\{\)\}=e​\(g,g\)Δi​j,kℓ⋅Δi​j,kℓ\\displaystyle=e\(g,g\)^\{\\Delta\_\{ij,k\_\{\\ell\}\}\\cdot\\Delta\_\{ij,k\_\{\\ell\}\}\}\(bilinearity:​e​\(ga,gb\)=e​\(g,g\)a​b​\)\\displaystyle\\hskip 10\.00002pt\\text\{\\small\(bilinearity: \}e\(g^\{a\},g^\{b\}\)=e\(g,g\)^\{ab\}\\text\{\)\}=e​\(g0,g0\)r2⋅\(ui,kℓ−uj,kℓ\)2\\displaystyle=e\(g\_\{0\},g\_\{0\}\)^\{r^\{2\}\\cdot\(u\_\{i,k\_\{\\ell\}\}\-u\_\{j,k\_\{\\ell\}\}\)^\{2\}\}=e​\(g0,g0\)di​j,kℓ\.\\displaystyle=e\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{\\ell\}\}\}\.
Since the protocol establishes this relation,e​\(g0,g0\)r2⋅\(ui,kℓ−uj,kℓ\)2=e​\(g0,g0\)di​j,kℓ\.e\(g\_\{0\},g\_\{0\}\)^\{r^\{2\}\\cdot\(u\_\{i,k\_\{\\ell\}\}\-u\_\{j,k\_\{\\ell\}\}\)^\{2\}\}=e\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{\\ell\}\}\}\.Becausee​\(g0,g0\)e\(g\_\{0\},g\_\{0\}\)generates𝔾T\\mathbb\{G\}\_\{T\}, exponents coincide modpp, yielding the stated equality\.

di​j,kℓ=r2⋅\(ui,kℓ−uj,kℓ\)2modp\.d\_\{ij,k\_\{\\ell\}\}\\;=\\;r^\{2\}\\cdot\(u\_\{i,k\_\{\\ell\}\}\-u\_\{j,k\_\{\\ell\}\}\)^\{2\}\\bmod p\.The peer server verifies these commitments with the above test\. The passing check guarantees that serverkkhas performed the aggregation correctly\. Once all checks pass, either server \(at least one is assumed to be honest\) computes then−f−2n\\\!\-\\\!f\\\!\-\\\!2smallest \(scaled\) pairwise distances for every client, sums them to obtain the Krum score, and selects the update with the minimal score as the next global model \(using SCO and SF\)\. Because the mask preserves distance ordering, the plaintext post\-processing is identical to the classical Krum rule, while preserving privacy\.

#### 4\.4\.2PRoVeFL\-enabled Trimmed\-Mean \(Figure[5](https://arxiv.org/html/2607.06612#S4.F5)\)

Input:Each serverkkreceives a set ofnnencrypted client updates\{ci,k=Enc𝗉𝗄⁡\(r⋅ui,k\):i=1,2,…,n\}\\\{c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{i,k\}\\right\):i=1,2,\\dots,n\\\}, whereui,ku\_\{i,k\}iskt​hk^\{th\}subset of client update of clienti\.Server\-Side Encrypted Operations\.Encrypted operations1\.For every ordered pair\(i,j\)\(i,j\)the servers compute,Enc𝗉𝗄⁡\(di​jk\)=\(ci,k−cj,k\),∀j≠i\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(d\_\{ij\_\{k\}\}\\right\)=\(c\_\{i,k\}\-c\_\{j,k\}\),\\quad\\forall j\\neq i\.Note that,Enc𝗉𝗄⁡\(di​jk\)=Enc𝗉𝗄⁡\(r⋅ui,k−r⋅uj,k\)\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(d\_\{ij\_\{k\}\}\\right\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{i,k\}\-r\\cdot u\_\{j,k\}\\right\)\.2\.Collaborative decryption\.Decrypt to obtaindi​jk=r⋅\(ui,k−uj,k\)d\_\{ij\_\{k\}\}=r\\cdot\(u\_\{i,k\}\-u\_\{j,k\}\)\.Verification of Correct Computation\.3\.Server publishesg0di​j,klg\_\{0\}^\{d\_\{ij,k\_\{l\}\}\}as a proof for correct computation \(for every coordinateℓ\\ell\)\.4\.Peer Server: For every coordinateℓ\\elland pair\(i,j\)\(i,j\)check,hi​kℓ⋅\(hj​kℓ\)−1modp=?g0di​j,klmodp\.h\_\{ik\_\{\\ell\}\}\\cdot\(h\_\{jk\_\{\\ell\}\}\)^\{\-1\}\\mod p\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}g\_\{0\}^\{d\_\{ij,k\_\{l\}\}\}\\mod p\.Plaintext operations5\.Coordinate\-wise sorting:The sign of each coordinate ofdi​jkd\_\{ij\_\{k\}\}represents the order of coordinates at that position in two updates\.\(a\)Fromdi​jkd\_\{ij\_\{k\}\}, we can prepare a binary sign vectors​g​nsgn, such thats​g​nl=\{0,if​ui,kl≤uj,kl1,otherwisesgn\_\{l\}=\\begin\{cases\}0,&\\text\{if \}u\_\{i,k\_\{l\}\}\\leq u\_\{j,k\_\{l\}\}\\\\ 1,&\\text\{otherwise\}\\end\{cases\}\.\(b\)Then, prepare a1vector containing11in each coordinate i\.e\.1=\(1,1,…,1\)\\textbf\{1\}=\(1,1,\\dots,1\)\.\(c\)Create temporary vectors as below:Enc𝗉𝗄⁡\(t​m​p1\)=s​g​n⋅Enc𝗉𝗄⁡\(uj​k\)\\displaystyle\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(tmp\_\{1\}\\right\)=sgn\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{jk\}\\right\)\+\(1−s​g​n\)⋅Enc𝗉𝗄⁡\(ui​k\)\\displaystyle\+\(\\textbf\{1\}\-sgn\)\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{ik\}\\right\)Enc𝗉𝗄⁡\(t​m​p2\)=s​g​n⋅Enc𝗉𝗄⁡\(ui​k\)\\displaystyle\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(tmp\_\{2\}\\right\)=sgn\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{ik\}\\right\)\+\(1−s​g​n\)​Enc𝗉𝗄⁡\(uj​k\)\.\\displaystyle\+\(\\textbf\{1\}\-sgn\)\\,\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{jk\}\\right\)\\,\.\(d\)Enc𝗉𝗄⁡\(t​m​p1\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(tmp\_\{1\}\\right\)andEnc𝗉𝗄⁡\(t​m​p2\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(tmp\_\{2\}\\right\)are sorted vectors, so we can assign them back toEnc𝗉𝗄⁡\(ui​k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{ik\}\\right\)andEnc𝗉𝗄⁡\(uj​k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(u\_\{jk\}\\right\), respectively\. This process repeats until the coordinates from all local model updates are sorted\.6\.Trim extremes:This step is computed as for plaintext, pruning the top and bottomffupdates\.7\.Selection:FedAvg can be applied on the selected updates\.

Figure 5:Trimmed\-Mean inPRoVeFL\.Upon receiving the masked ciphertextsci,k=Enc𝗉𝗄⁡\(r​ui,k\)c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\,u\_\{i,k\}\)for every clientii, each serverkkhomomorphically subtracts every ordered pair\(i,j\)\(i,j\)to obtain the encrypted coordinate\-wise differencesEnc𝗉𝗄⁡\(di​j,k\)=\(ci,k−cj,k\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(d\_\{ij,k\}\)\\\!=\\\!\(c\_\{i,k\}\-c\_\{j,k\}\), via PSE\. A collaborative decryption then reveals only the obfuscated valuesdi​j,k=r​\(ui,k−uj,k\)d\_\{ij,k\}=r\\,\(u\_\{i,k\}\-u\_\{j,k\}\)\. For each coordinateℓ\\ell, the honest peer checks the relationhi,kℓ​hj,kℓ−1≡g0di​j,kℓ\(modp\)h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\}\\equiv g\_\{0\}^\{d\_\{ij,k\_\{\\ell\}\}\}\\pmod\{p\}, thus ensuring the correctness of every difference without exposing plaintext updates\. A binary sign vector derived from the decrypteddi​j,kd\_\{ij,k\}guides a homomorphic rearrangement that sorts the encrypted coordinates in ascending order \(SCO\)\. Servers perform a secure compare\-and\-swap procedure, realised by Batcher’s odd\-even mergesort network, on the ciphertexts\. Batcher’s odd–even mergesort network executes a data‐independent sequence of𝒪​\(n​log2⁡n\)\\mathcal\{O\}\(n\\log^\{2\}n\)compare‐and‐swap operations, in contrast to the𝒪​\(n2\)\\mathcal\{O\}\(n^\{2\}\)pairwise comparisons required by naive sorting\. By integrating this network into Trimmed Mean, servers can efficiently perform coordinate\-wise sorting over encrypted client updates, reducing the number of comparisons and overall computation compared to a fully quadratic approach\. Once sorting is complete, the largest and smallestffvalues are discarded \(SF\), and the remainingn−2​fn\-2fentries per dimension are averaged\. Because the random maskrrpreserves relative ordering, this plaintext post\-processing exactly reproduces the classical The trimmed\-mean rule, where all expensive computations, i\.e\., sorting, are done in the combined plaintext\-ciphertext domain\.

#### 4\.4\.3PRoVeFL\-enabled FLTrust \(Figure[6](https://arxiv.org/html/2607.06612#S4.F6)\)

Input:•Each serverkkreceives a set ofnnencrypted client updates\{ci,k=Enc𝗉𝗄⁡\(r⋅ui,k\):i=1,2,…,n\}\\\{c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{i,k\}\\right\):i=1,2,\\dots,n\\\}, whereui,ku\_\{i,k\}iskt​hk^\{th\}subset of client update of clienti\.•Additionally receives encrypted norm\{ei=Enc𝗉𝗄⁡\(r‖ui‖\):i=1,2,…,n\}\\\{e\_\{i\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\\frac\{r\}\{\\\|u\_\{i\}\\\|\}\\right\):i=1,2,\\dots,n\\\}\[Note \- It can also be calculated privately at the server side\.\]•Server Update Vector:u0,‖u0‖u\_\{0\},\\\|u\_\{0\}\\\|Server\-Side Encrypted Operations\.1\.Coordinate\-wise products\.For each clientiiEnc𝗉𝗄⁡\(di\)=u0⊙ci,k=Enc𝗉𝗄⁡\(r⋅ui,k⊙u0\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(d\_\{i\}\)\\;=\\;u\_\{0\}\\odot c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\cdot u\_\{i,k\}\\odot u\_\{0\}\)2\.Collaborative decryption\.Decrypt to obtaindid\_\{i\}Verification of Correct Computation\.3\.Server Publishesg0dilg\_\{0\}^\{d\_\{i\_\{l\}\}\}as a proof for the correct computation \(for every coordinateℓ\\ell\)\.4\.Peer Server: For everyℓ\\ellcheckhi,klutl=?gdil\.h\_\{i,k\_\{l\}\}^\{u\_\{t\_\{l\}\}\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}g^\{d\_\{i\_\{l\}\}\}\.5\.Abort on the first mismatch\.Plaintext operations6\.Trust score\.wi=max⁡\{0,∑ℓ=1Ndi,ℓ‖u0‖\}\.w\_\{i\}=\\max\\left\\\{0,\\quad\\frac\{\\sum\_\{\\ell=1\}^\{N\}d\_\{i,\\ell\}\}\{\\\|u\_\{0\}\\\|\}\\right\\\}\\;\.7\.Scaled UpdatesEnc𝗉𝗄⁡\(uiscaled\)=Enc𝗉𝗄⁡\(wi⋅‖u0‖‖ui‖⋅ui\),\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u\_\{i\}^\{\\text\{scaled\}\}\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(w\_\{i\}\\cdot\\frac\{\\\|u\_\{0\}\\\|\}\{\\\|u\_\{i\}\\\|\}\\cdot u\_\{i\}\\right\),=\(wi⋅‖u0‖\)⋅Enc𝗉𝗄⁡\(1‖ui‖\)⋅Enc𝗉𝗄⁡\(ui\)\.=\\left\(w\_\{i\}\\cdot\\\|u\_\{0\}\\\|\\right\)\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\\frac\{1\}\{\\\|u\_\{i\}\\\|\}\\right\)\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u\_\{i\}\)\.8\.Weighted Aggregation\.Enc𝗉𝗄⁡\(ut\+1\)=1∑i=1nwi⋅∑i=1nEnc𝗉𝗄⁡\(uiscaled\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u^\{t\+1\}\)=\\frac\{1\}\{\\sum\_\{i=1\}^\{n\}w\_\{i\}\}\\cdot\\sum\_\{i=1\}^\{n\}\{\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u\_\{i\}^\{\\text\{scaled\}\}\)\}

Figure 6:FLTrust inPRoVeFL\.Every server𝒮k\\mathcal\{S\}\_\{k\}receives for each clientii\(i\) a masked ciphertext shareci,k=Enc𝗉𝗄⁡\(r⋅ui,k\)c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\cdot u\_\{i,k\}\)and \(ii\) the encrypted reciprocal normei=Enc𝗉𝗄⁡\(‖ui‖−1\)e\_\{i\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\\!\\bigl\(\\\|u\_\{i\}\\\|^\{\-1\}\\bigr\); the server itself holds the trusted reference vectoru0u\_\{0\}and its norm‖u0‖\\\|u\_\{0\}\\\|\. These computations rely on linear aggregation \(LA\)\. It first evaluates, under encryption, the coordinate\-wise productsEnc𝗉𝗄⁡\(di\)=Enc𝗉𝗄⁡\(r⋅ui,k⊙u0\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(d\_\{i\}\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\\!\\bigl\(r\\cdot u\_\{i,k\}\\odot u\_\{0\}\\bigr\)\. A threshold decryption reveals only the masked inner product vectordi=r⋅ui,k⊙u0d\_\{i\}=r\\cdot u\_\{i,k\}\\odot u\_\{0\}\. For every coordinateℓ\\ellthe peer server verifieshi,kℓut,ℓ=?gdi,ℓh\_\{i,k\_\{\\ell\}\}^\{\\,u\_\{t,\\ell\}\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}g^\{d\_\{i,\\ell\}\}; failure of any check aborts the protocol, ensuring integrity via the discrete\-log assumption\. When all checks pass, the score vectors are concatenated to formdi∈ℝNd\_\{i\}\\in\\mathbb\{R\}^\{N\}\. Each server then computes the client’s FLTrust weightwi=max⁡\{0,∑ℓ=1Ndi,ℓ/‖u0‖\},w\_\{i\}=\\max\\\{0,\\sum\_\{\\ell=1\}^\{N\}d\_\{i,\\ell\}/\\\|u\_\{0\}\\\|\\\},a quantity still proportional to the true cosine similarity\. Finally, the update is rescaled homomorphically \(LA\):

Enc𝗉𝗄⁡\(uiscaled\)=Enc𝗉𝗄⁡\(wi​‖u0‖‖ui‖​ui\),\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u\_\{i\}^\{\\text\{scaled\}\}\)=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\\!\\bigl\(w\_\{i\}\\,\\tfrac\{\\\|u\_\{0\}\\\|\}\{\\\|u\_\{i\}\\\|\}\\,u\_\{i\}\\bigr\),and the weighted averageEnc𝗉𝗄⁡\(ut\+1\)=\(∑iwi\)−1​∑iEnc𝗉𝗄⁡\(uiscaled\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(u^\{t\+1\}\)=\\bigl\(\\sum\_\{i\}w\_\{i\}\\bigr\)^\{\-1\}\\\!\\sum\_\{i\}\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\\!\\bigl\(u\_\{i\}^\{\\text\{scaled\}\}\\bigr\)is produced under encryption\.

#### 4\.4\.4Enabling other aggregation schemes

Beyond the three schemes instantiated above,PRoVeFL’s modular design extends naturally to a broad class of Byzantine\-robust aggregation schemes\. We observe that defenses such as MESAS\[[29](https://arxiv.org/html/2607.06612#bib.bib8)\], CrowdGuard\[[43](https://arxiv.org/html/2607.06612#bib.bib7)\], and FLAME\[[41](https://arxiv.org/html/2607.06612#bib.bib6)\]can be tailored toPRoVeFL\. FLAME computes cosine similarity and performs clustering after that \(LA, PSE\)\. Further, it computes the Euclidean distance and finds the median for adaptive clipping \(SCO\)\. As discussed above, most of these statistical operations can be tailored toPRoVeFL\. CrowdGuard also computes layer\-wise Cosine and Euclidean distances, which we have already demonstrated with Krum and FLTrust\. MESAS includes six statistical operations, including cosine similarity, Euclidean distance, count, variance, maximum, and minimum \(PSE\)\. Subsequently, it performs multiple clustering\-based statistical tests to prune \(LA, SF\)\. Since MESAS covers the full set of statistical operations, we describe how to tailor it toPRoVeFL\. Details can be referred to in[A](https://arxiv.org/html/2607.06612#A1)\.

## 5Security Analysis

This section establishes that the proposed protocol guarantees confidentiality and integrity against both honest\-but\-curious and actively malicious aggregation servers\. All reductions invoke the*Decisional Ring–LWE*assumption for ciphertext privacy and the hardness of the*Discrete Logarithm Problem*\(DLP\) in a prime\-order group for commitment soundness\.

Throughout, let𝒮1,𝒮2\\mathcal\{S\}\_\{1\},\\mathcal\{S\}\_\{2\}be the two aggregation servers,𝗉𝗄\\mathsf\{pk\}the public multi\-key FHE key, and let

𝗏𝗂𝖾𝗐kpre=\{ci,k,hi,kℓ,ei\}i,ℓ\\mathsf\{view\}^\{\\mathrm\{pre\}\}\_\{k\}\\;=\\;\\bigl\\\{\\,c\_\{i,k\},\\,h\_\{i,k\_\{\\ell\}\},\\,e\_\{i\}\\bigr\\\}\_\{i,\\ell\}denote the entire information set available to server𝒮k\\mathcal\{S\}\_\{k\}*before*any homomorphic processing \(ci,k=Enc𝗉𝗄⁡\(r⋅ui,k\)c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(r\\cdot u\_\{i,k\}\),hi,kℓ=gui,kℓh\_\{i,k\_\{\\ell\}\}=g^\{u\_\{i,k\_\{\\ell\}\}\}, and, if required,ei=Enc𝗉𝗄⁡\(‖ui‖−1\)e\_\{i\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(\\\|u\_\{i\}\\\|^\{\-1\}\)\)\.

Let

𝗏𝗂𝖾𝗐kpost=𝗏𝗂𝖾𝗐kpre∪\{di∣i∈\[n\]\}\\mathsf\{view\}^\{\\mathrm\{post\}\}\_\{k\}\\;=\\;\\mathsf\{view\}^\{\\mathrm\{pre\}\}\_\{k\}\\cup\\bigl\\\{\\,d\_\{i\}\\mid i\\in\[n\]\\bigr\\\}be the information set*after*collaborative decryption, wheredid\_\{i\}is either the masked pairwise‐distance vector \(Krum\), the masked coordinate difference vector \(Trimmed‐Mean\), or the masked inner‐product vector \(FLTrust\)\.

Further, each server publishes a proof elementgdi∈𝔾g^\{d\_\{i\}\}\\in\\mathbb\{G\}and extends their local view to

𝗏𝗂𝖾𝗐kproof=\{gdik∣i∈\[n\]\}\.\\mathsf\{view\}^\{\\mathrm\{proof\}\}\_\{k\}=\\\{g^\{d\_\{i\_\{k\}\}\}\\mid i\\in\[n\]\\\}\.
Each peer server validates the publishedgdig^\{d\_\{i\}\}against client commitmentshi,kℓh\_\{i,k\_\{\\ell\}\}using the method\-specific equation:

Krum:​e​\(hi,kℓ​hj,kℓ−1,hi,kℓ​hj,kℓ−1\)=?e​\(g,g\)di​j,kℓ\.\\text\{Krum:\}\\;e\\\!\\bigl\(h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\},h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\}\\bigr\)\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}e\(g,g\)^\{d\_\{ij,k\_\{\\ell\}\}\}\.Trimmed\-Mean:​hi,kℓ​hj,kℓ−1=?gdi​j,kℓ\.\\text\{Trimmed\-Mean:\}\\;h\_\{i,k\_\{\\ell\}\}h\_\{j,k\_\{\\ell\}\}^\{\-1\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}g^\{d\_\{ij,k\_\{\\ell\}\}\}\.FLTrust:​hi,kℓut,ℓ=?gdi,ℓ\.\\text\{FLTrust:\}\\;h\_\{i,k\_\{\\ell\}\}^\{u\_\{t,\\ell\}\}\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}g^\{d\_\{i,\\ell\}\}\.A single failure causes the honest server to withhold sharing a decrypted share, forcing an abort and preventing acceptance of the forged data\.

The sequence of Theorems[1](https://arxiv.org/html/2607.06612#Thmtheorem1)to[3](https://arxiv.org/html/2607.06612#Thmtheorem3)discussed in[B](https://arxiv.org/html/2607.06612#A2)to[D](https://arxiv.org/html/2607.06612#A4)uses the above views𝗏𝗂𝖾𝗐kpre\\mathsf\{view\}^\{\\mathrm\{pre\}\}\_\{k\},𝗏𝗂𝖾𝗐kpost\\mathsf\{view\}^\{\\mathrm\{post\}\}\_\{k\}, and𝗏𝗂𝖾𝗐kproof\\mathsf\{view\}^\{\\mathrm\{proof\}\}\_\{k\}to prove confidentiality and integrity for the entire protocol\.

## 6Evaluation

In this section, we present a comprehensive evaluation ofPRoVeFL, evaluating its computation, communication costs, robustness and verification cost analysis\.

### 6\.1Experimental setup

#### 6\.1\.1Implementation

All experiments are conducted on a system with Intel Xeon E5\-4650 v4 @ 2\.20 GHz with 112 logical CPUs, and 256 GB RAM\. We implemented our framework in C\+\+ using the Microsoft SEAL library111https://github\.com/microsoft/SEALfor homomorphic encryption\. Our code is available here222https://github\.com/harshkasyap/provefl\. For local model training, we used the PyTorch333https://github\.com/pytorch/pytorchframework\. We instantiated clients to run independently\. Multi\-key support and ciphertext packing are leveraged to maximize throughput\. All results reported are averaged over 5 independent runs, unless specified otherwise\.

#### 6\.1\.2Evaluation Goals

Our evaluation seeks to answer the following key questions:

##### Efficiency\.

What is the computational and communication overhead introduced by encrypted computation and partial decryption, to integrate state\-of\-the\-art Byzantine robust schemes? How doesPRoVeFLscale with increasing number of clients, servers, and model size?

##### Breakdown\.

What is the breakdown of individual components inPRoVeFL? We chose to show this to demonstrate the time savings from offloading computations to plaintext\.

##### Byzantine Robustness\.

How well does the system perform \(in terms of accuracy\) in the presence of Byzantine clients under various poisoning attacks \(Backdoor Attack, Trim Attack\) and state\-of\-the\-art Byzantine robust schemes tailored toPRoVeFL?

##### Comparative Performance\.

How doesPRoVeFLcompare to prior secure FL systems such as ELSA\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\], Prio\[[1](https://arxiv.org/html/2607.06612#bib.bib10),[10](https://arxiv.org/html/2607.06612#bib.bib11)\]and RoFL\[[6](https://arxiv.org/html/2607.06612#bib.bib12)\]? We chose these systems to compare with, since they cover single\-server and distributed servers and can support at least a Byzantine\-robust scheme \(norm clipping\)\.

##### Verification Cost\.

We analsze the verification cost incurred by the server to validate that the aggregation has been performed correctly, assuming that at least one server is honest\.

#### 6\.1\.3Parameters and Variations

We vary the following system parameters to study performance under different settings:

– Number of Clients \(C\): 10, 50, 100, 200\.

– Number of Servers \(S\): 2, 4, 10\.

– Dataset \- Model Size \(P\): \(1\) 100k and 500k for Benchmarking; \(2\) 62k \(CIFAR\-10 S\[[30](https://arxiv.org/html/2607.06612#bib.bib19)\]\- LeNet5\[[31](https://arxiv.org/html/2607.06612#bib.bib17)\]\); \(3\) 273k \(CIFAR\-10 L\[[30](https://arxiv.org/html/2607.06612#bib.bib19)\]\- ResNet\-18\[[23](https://arxiv.org/html/2607.06612#bib.bib18)\]\); \(4\) 818k \(Shakespeare\[[7](https://arxiv.org/html/2607.06612#bib.bib16)\]\- LSTM\[[24](https://arxiv.org/html/2607.06612#bib.bib15)\]\)

– Poisoning Attacks: Trim\[[13](https://arxiv.org/html/2607.06612#bib.bib37)\]and Backdoor\[[2](https://arxiv.org/html/2607.06612#bib.bib32)\]attacks\.

– Poisoning Client Fraction \(A%\): 10%, 20%, 40%\.

– Byzantine\-Robust Aggregation Rules:L2L\_\{2\}norm \(for comparison\), Krum\[[5](https://arxiv.org/html/2607.06612#bib.bib40)\], Trimmed Mean\[[56](https://arxiv.org/html/2607.06612#bib.bib41)\], FLTrust\[[8](https://arxiv.org/html/2607.06612#bib.bib42)\]\.

– Baselines: ELSA\[[42](https://arxiv.org/html/2607.06612#bib.bib60)\], RoFL\[[6](https://arxiv.org/html/2607.06612#bib.bib12)\], Prio\[[10](https://arxiv.org/html/2607.06612#bib.bib11),[1](https://arxiv.org/html/2607.06612#bib.bib10)\]\.

– FHE polynomial modulus degree \- 32768\.

101050501001002002000112233\# ClientsTime \(s\)L2 Norm2 servers4 servers10 servers1010505010010020020002002004004006006008008001,0001\{,\}000\# ClientsKrum101050501001002002000100100200200300300400400\# ClientsTrimmed Mean10105050100100200200055101015152020\# ClientsFLTrust
Figure 7:Computation time vs\. no\. of clients \(and servers\) for different Byzantine\-robust aggregation rules \(100k params\)\.10105050100100200200011223344\# ClientsTime \(s\)L2 Norm62k273k818k1010505010010020020001,0001\{,\}0002,0002\{,\}000\#ClientsKrum101050501001002002000200200400400600600\#ClientsTrimmed\-Mean10105050100100200200020204040\#ClientsFLTrust
Figure 8:Computation time vs\. no\. of clients \(with 2 servers\) for different Byzantine\-robust aggregation rules acrossdifferentmodel sizes \(and datasets\)\. 62k \(CIFAR\-10 S \- LeNet5\), 273k \(CIFAR\-10 L \- ResNet\-18\), 818k \(Shakespeare \- LSTM\)\.Table 2:Communication cost \(in GB\) vs\. no\. of clients with 2 servers \(100k Params\)\.0\(P\)010204087878888898990909191AdversariesAccuracy \(%\)Trim AttackKrumT\-MeanFLTrust0\(P\)010204087878888898990909191AdversariesBackdoor Attack
Figure 9:Accuracy under Trim and Backdoor Attacks for different aggregation rules \(CIFAR\-10 L \- ResNet\-18\)\. P: Plaintext, Rest: Encrypted and simulated with 2 servers\.Table 3:Computation and Communication Cost \(in MB\) for Different MethodsTable 4:Computation time \(in seconds\) and communication \(in GB\) for different model sizes \(and datasets\)\.

### 6\.2Results

#### 6\.2\.1Efficiency

Figure[7](https://arxiv.org/html/2607.06612#S6.F7)presents a comparative analysis of computation time across four Byzantine\-robust aggregation rules:L2L\_\{2\}Norm, Krum, Trimmed Mean, and FLTrust, with varying numbers of clients \(10, 50, 100, 200\) and server counts \(2, 4, 10\)\.

We observe thatL2L\_\{2\}Norm exhibits the lowest and most stable computation time across all configurations, with only a modest increase as the client count grows, and minimal variation with server scaling\. Krum incurs a high computational cost, especially with larger client counts, due to its pairwise distance computations\. This cost is alleviated by increasing the number of servers\. Trimmed Mean also benefits notably from increased server parallelism, suggesting good scalability\. However, the costs of Krum and Trimmed Mean are inherently quadratic in the number of clients, since they compare all pairs of updates, whereas the costs of L2 norm and FLTrust are linear in the number of clients\.

Figure[8](https://arxiv.org/html/2607.06612#S6.F8)demonstrates the server\-side computation time as the number of clients increases across models of varying sizes \(different datasets, two servers\)\. TheL2L\_\{2\}Norm method, being the simplest, exhibits linear scaling and remains computationally efficient even with 200 clients and large models\. As noted earlier, Krum is significantly more expensive due to pairwise distance calculations, resulting in prohibitive delays for large\-scale deployments\. Trimmed\-Mean offers an acceptable cost along with scalability\. FLTrust maintains scalability similar to that of theL2L\_\{2\}Norm\. The costs of Krum and Trimmed Mean are inherently quadratic in the number of clients, since they compare all pairs of updates, whereas the costs ofL2L\_\{2\}norm and FLTrust are linear in the number of clients\.

Table[2](https://arxiv.org/html/2607.06612#S6.T2)presents the communication cost \(in GB\) incurred under different Byzantine\-robust aggregation rules as the number of clients increases, assuming two servers and a fixed model size of 100k parameters\.L2L\_\{2\}norm shows a constant communication cost of 0\.005 GB, regardless of the number of clients\. This is because it requires only aggregated statistics to be shared with the servers, making it highly communication\-efficient\. Krum’s communication cost grows to over 26 GB for 200 clients because each client must exchange partial distance computations with all others\. Trimmed\-Mean scales more moderately than Krum, as it requires fewer exchanges, since we utilized the index pairs from Batcher’s odd\-even mergesort network\. FLTrust has a significantly lower cost than Krum and Trimmed\-Mean\. We refer to[E](https://arxiv.org/html/2607.06612#A5)for the runtime breakdown\.

#### 6\.2\.2Byzantine Robustness

Figure[9](https://arxiv.org/html/2607.06612#S6.F9)demonstrates that all three aggregation rules \(Krum, Trimmed\-Mean, and FLTrust\) maintain high accuracy even when clients’ updates are encrypted and subjected to increasing proportions of adversarial clients \(performing Trim\[[13](https://arxiv.org/html/2607.06612#bib.bib37)\]and Backdoor\[[2](https://arxiv.org/html/2607.06612#bib.bib32)\]attacks\)\. With no attack \(both in plaintext and encrypted cases\), each method achieves around 90% accuracy\. As the adversarial fraction increases to 40%, the accuracy drop is minimal\. These results confirm that, despite the added encryption overhead and targeted attacks, the robust aggregation schemes continue to behave as intended when implemented withinPRoVeFL\.

#### 6\.2\.3Comparative Performance

Table[3](https://arxiv.org/html/2607.06612#S6.T3)compares the computation time per client and per server \(in seconds\) and the communication cost \(in MB\) between different methods\. We assume a relaxedL∞L\_\{\\infty\}defense for comparison, because ELSA does not support complex defenses, whereas Prio needs adjustments to run anL2L\_\{2\}norm defense as well\. Prio incurs the highest overhead, with per\-client costs exceeding 78s and 262MB for larger models \(500k parameters\), and server communication scaling linearly with the number of clients\. ELSA improves client\-side computation but suffers from excessive server communication and computation, particularly at larger scales \(e\.g\., 31\.4s and 12\.5GB at 200 clients\)\.

PRoVeFLsignificantly reduces overhead for both clients and servers\. In all configurations, client computation remains less than 1s, and communication cost is bounded \(10–20MB\), making it suitable for deployment even on edge devices\. Server\-side costs scale modestly with the number of clients and remain well within practical limits, while communication costs are held constant by efficient encrypted aggregation\. Notably, using 4 servers instead of 2 further balances the load without increasing overall communication\. These results demonstrate thatPRoVeFLachieves scalability and practical efficiency, outperforming existing approaches\.

Table[4](https://arxiv.org/html/2607.06612#S6.T4)evaluates how computation time and communication scale with increasing model size across RoFL, ELSA, andPRoVeFL\. RoFL exhibits extremely high computation costs \(up to 4742s\) and communication overheads, making it impractical for large models\. ELSA significantly reduces computation time compared to RoFL, but still incurs high communication costs that scale linearly with model size\. In contrast,PRoVeFLmaintains low and stable computation times, even for the largest model and drastically reduces communication overhead, up to 17 MB\. This demonstrates thatPRoVeFLis far more efficient and scalable than existing solutions, and also supports complex aggregation rules\.

#### 6\.2\.4Verification Cost Analysis

LetNNbe the full update dimension andn=N/2n=N/2the number of coordinates held by each server\. For every coordinateℓ∈\{1,…,n\}\\ell\\in\\\{1,\\dots,n\\\}, the honest peer checks the proof returned by the other server\. Table[5](https://arxiv.org/html/2607.06612#S6.T5)counts,*per coordinate*, the two dominant operations:

- •𝖤𝗑𝗉\\mathsf\{Exp\}: a modular exponentiation in the source group \(𝔾\\mathbb\{G\}or𝔾T\\mathbb\{G\}\_\{T\}\);
- •𝖯𝖺𝗂𝗋\\mathsf\{Pair\}: a single evaluation of the bilinear pairinge:𝔾×𝔾→𝔾Te\\colon\\mathbb\{G\}\\times\\mathbb\{G\}\\to\\mathbb\{G\}\_\{T\}\.

Table 5:Verification cost per coordinate \(the honest peer performs the same test for alln=N/mn=N/mcoordinates\)\.##### Aggregate cost

Multiplying the per\-coordinate counts bynnyields the total work per round:

Krum:n​𝖤𝗑𝗉\+n​𝖯𝖺𝗂𝗋,\\displaystyle\\quad n\\,\\mathsf\{Exp\}\+n\\,\\mathsf\{Pair\},Trimmed\-Mean:n​𝖤𝗑𝗉,\\displaystyle\\quad n\\,\\mathsf\{Exp\},FLTrust:2​n​𝖤𝗑𝗉\.\\displaystyle\\quad 2n\\,\\mathsf\{Exp\}\.
Because a single pairing is typically an order of magnitude slower than a modular exponentiation, Krum incurs the highest overhead In all three cases, the verification effort scales linearly with the model dimension and is independent of the number of clients, ensuring scalability to high\-dimensional updates\.

#### 6\.2\.5Limitations

PRoVeFLis compatible with a broad class of Byzantine\-robust aggregation schemes, where relevant structural properties such as ordering, sign, or magnitude ratios are preserved under multiplicative masking and the operations can also be distributed among multiple servers to jointly calculate the final value\. This holds for distance\-based, similarity\-based, and sorting\-based operations\. However, there do exist some aggregation schemes, such as Min\-Max and Min\-Sum\[[46](https://arxiv.org/html/2607.06612#bib.bib30)\], that apply non\-linear transformations to client updates or rely on adaptive thresholds that are themselves functions of the unmasked data, and thus cannot be straightforwardly instantiated inPRoVeFL\.

## 7Conclusion

This work presented a practically efficient and provably secure federated learning frameworkPRoVeFLbased on multiparty key homomorphic encryption utilised by multiple servers\. It is designed to address the challenges of data confidentiality and data aggregation integrity in the presence of malicious participants and servers\. By distributing encrypted computation across multiple servers and introducing collaborative randomization to obfuscate sensitive intermediate values,PRoVeFLachieves scalability without compromising privacy\. The framework supports different Byzantine\-robust aggregation mechanisms, such as Krum, Trimmed Mean, FLTrust and MESAS directly on encrypted inputs, demonstrating resilience against both inference and poisoning attacks\. The ability to efficiently integrate verification checks, traditionally impractical in pure FHE settings, further underscores the deployability of our solution\.

## CRediT authorship contribution statement

Harsh Kasyap, Anil Kumar Pradhan, and Ugur Ilker Atmaca are responsible for the design of the scheme, the experiment, and the writing of the paper\. Graham Cormode and Carsten Maple are responsible for the design of the scheme and editing of the paper\.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper\.

## Data availability

Public data has been used\.

## Acknowledgment

This work is supported, in part, by the UKRI Prosperity Partnership Scheme \(FAIR\) under the EPSRC Grant EP/V056883/1; EP/R007195/1 \(Academic Centre of Excellence in Cyber Security Research \- University of Warwick\); EP/N510129/1 \(The Alan Turing Institute\); the Bill and Melinda Gates Foundation \[INV\-001309\]\. Under the grant conditions of the Foundation, a Creative Commons Attribution 4\.0 Generic License has already been assigned to the Author Accepted Manuscript version that might arise from this submission\. The author gratefully acknowledges the support provided by the Department of Science and Technology \(DST\), Government of India, through the INSPIRE Faculty Fellowship scheme\.

## References

- \[1\]S\. Addanki, K\. Garbe, E\. Jaffe, R\. Ostrovsky, and A\. Polychroniadou\(2022\)Prio\+: privacy preserving aggregate statistics via boolean shares\.InInternational Conference on Security and Cryptography for Networks,pp\. 516–539\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.5.5.5.2),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1),[§6\.1\.2](https://arxiv.org/html/2607.06612#S6.SS1.SSS2.Px4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p8.1)\.
- \[2\]E\. Bagdasaryan, A\. Veit, Y\. Hua, D\. Estrin, and V\. Shmatikov\(2020\)How to backdoor federated learning\.InInternational Conference on Artificial Intelligence and Statistics,pp\. 2938–2948\.Cited by:[¶2\.1\.1\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P1.p1.2),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p5.1),[§6\.2\.2](https://arxiv.org/html/2607.06612#S6.SS2.SSS2.p1.1)\.
- \[3\]G\. Baruch, M\. Baruch, and Y\. Goldberg\(2019\)A little is enough: circumventing defenses for distributed learning\.Advances in Neural Information Processing Systems32\.Cited by:[¶2\.1\.1\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P1.p1.2)\.
- \[4\]J\. Bell, A\. Gascón, T\. Lepoint, B\. Li, S\. Meiklejohn, M\. Raykova, and C\. Yun\(2023\)ACORN: input validation for secure aggregation\.In32nd USENIX Security Symposium \(USENIX Security 23\),pp\. 4805–4822\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.17.8.1),[§1](https://arxiv.org/html/2607.06612#S1.p2.1)\.
- \[5\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.InNeural Information Processing Systems,pp\. 118–128\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p3.4),[¶2\.1\.2\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS2.P1.p1.2),[§4\.4](https://arxiv.org/html/2607.06612#S4.SS4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p7.1)\.
- \[6\]L\. Burkhalter, H\. Lycklama, A\. Viand, N\. Küchler, and A\. Hithnawi\(2021\)Rofl: attestable robustness for secure federated learning\.arXiv preprint arXiv:2107\.0331121\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.20.11.1),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1),[§6\.1\.2](https://arxiv.org/html/2607.06612#S6.SS1.SSS2.Px4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p8.1)\.
- \[7\]S\. Caldas, S\. M\. K\. Duddu, P\. Wu, T\. Li, J\. Konečnỳ, H\. B\. McMahan, V\. Smith, and A\. Talwalkar\(2018\)Leaf: a benchmark for federated settings\.arXiv preprint arXiv:1812\.01097\.Cited by:[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p4.1)\.
- \[8\]X\. Cao, M\. Fang, J\. Liu, and N\. Gong\(2021\)FLTrust: byzantine\-robust federated learning via trust bootstrapping\.InNDSS,Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p3.4),[¶2\.1\.2\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS2.P3.p1.1),[§4\.4](https://arxiv.org/html/2607.06612#S4.SS4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p7.1)\.
- \[9\]J\. H\. Cheon, A\. Kim, M\. Kim, and Y\. Song\(2017\)Homomorphic encryption for arithmetic of approximate numbers\.InAdvances in cryptology–ASIACRYPT international conference on the theory and applications of cryptology and information security,pp\. 409–437\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p4.1)\.
- \[10\]H\. Corrigan\-Gibbs and D\. Boneh\(2017\)Prio: private, robust, and scalable computation of aggregate statistics\.In14th USENIX symposium on networked systems design and implementation \(NSDI 17\),pp\. 259–282\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.4.4.4.2),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1),[§6\.1\.2](https://arxiv.org/html/2607.06612#S6.SS1.SSS2.Px4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p8.1)\.
- \[11\]A\. I\. C\. Divisors\(2017\)Order\-preserving encryption using approximate integer common divisors\.InData Privacy Management, Cryptocurrencies and Blockchain Technology: ESORICS International Workshops,pp\. 257\.Cited by:[§4\.2\.5](https://arxiv.org/html/2607.06612#S4.SS2.SSS5.p1.9)\.
- \[12\]W\. Du, M\. Li, L\. Wu, Y\. Han, T\. Zhou, and X\. Yang\(2023\)A efficient and robust privacy\-preserving framework for cross\-device federated learning\.Complex & Intelligent Systems9\(5\),pp\. 4923–4937\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p4.1),[§2\.2](https://arxiv.org/html/2607.06612#S2.SS2.p1.1)\.
- \[13\]M\. Fang, X\. Cao, J\. Jia, and N\. Gong\(2020\)Local model poisoning attacks to Byzantine\-Robust federated learning\.In29th USENIX security symposium,pp\. 1605–1622\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1),[¶2\.1\.1\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P1.p1.2),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p5.1),[§6\.2\.2](https://arxiv.org/html/2607.06612#S6.SS2.SSS2.p1.1)\.
- \[14\]N\. Franzese, A\. Dziedzic, C\. A\. Choquette\-Choo, M\. R\. Thomas, M\. A\. Kaleem, S\. Rabanser, C\. Fang, S\. Jha, N\. Papernot, and X\. Wang\(2023\)Robust and actively secure serverless collaborative learning\.Advances in Neural Information Processing Systems36,pp\. 39504–39528\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p2.1),[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.14.5.1),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p2.1)\.
- \[15\]M\. Fredrikson, S\. Jha, and T\. Ristenpart\(2015\)Model inversion attacks that exploit confidence information and basic countermeasures\.InACM SIGSAC conference on computer and communications security,pp\. 1322–1333\.Cited by:[¶2\.1\.1\.2](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P2.p1.1)\.
- \[16\]C\. Fu, X\. Zhang, S\. Ji, J\. Chen, J\. Wu, S\. Guo, J\. Zhou, A\. X\. Liu, and T\. Wang\(2022\)Label inference attacks against vertical federated learning\.In31st USENIX security symposium,pp\. 1397–1414\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1),[§1](https://arxiv.org/html/2607.06612#S1.p2.1)\.
- \[17\]K\. Ganju, Q\. Wang, W\. Yang, C\. A\. Gunter, and N\. Borisov\(2018\)Property inference attacks on fully connected neural networks using permutation invariant representations\.InACM SIGSAC conference on computer and communications security,pp\. 619–633\.Cited by:[¶2\.1\.1\.2](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P2.p1.1)\.
- \[18\]H\. Gao, N\. He, and T\. Gao\(2023\)SVeriFL: successive verifiable federated learning with privacy\-preserving\.Information Sciences622,pp\. 98–114\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p3.1)\.
- \[19\]J\. Gao, B\. Hou, X\. Guo, Z\. Liu, Y\. Zhang, K\. Chen, and J\. Li\(2021\)Secure aggregation is insecure: category inference attack on federated learning\.IEEE Transactions on Dependable and Secure Computing20\(1\),pp\. 147–160\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p2.1)\.
- \[20\]T\. Gehlhar, F\. Marx, T\. Schneider, A\. Suresh, T\. Wehrle, and H\. Yalame\(2023\)SafeFL: mpc\-friendly framework for private and robust federated learning\.InIEEE Security and Privacy Workshops \(SPW\),pp\. 69–76\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p2.1),[Table 1](https://arxiv.org/html/2607.06612#S1.T1.2.2.2.2),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1)\.
- \[21\]C\. Gentry\(2009\)A fully homomorphic encryption scheme\.Stanford university\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p4.1)\.
- \[22\]X\. Guo, Z\. Liu, J\. Li, J\. Gao, B\. Hou, C\. Dong, and T\. Baker\(2020\)V eri fl: communication\-efficient and fast verifiable aggregation for federated learning\.IEEE Transactions on Information Forensics and Security16,pp\. 1736–1751\.Cited by:[¶2\.1\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P3.p1.1)\.
- \[23\]K\. He, X\. Zhang, S\. Ren, and J\. Sun\(2016\)Deep residual learning for image recognition\.InComputer vision and pattern recognition,pp\. 770–778\.Cited by:[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p4.1)\.
- \[24\]S\. Hochreiter and J\. Schmidhuber\(1997\)Long short\-term memory\.Neural computation9\(8\),pp\. 1735–1780\.Cited by:[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p4.1)\.
- \[25\]H\. Hu, Z\. Salcic, L\. Sun, G\. Dobbie, and X\. Zhang\(2021\)Source inference attacks in federated learning\.InInternational Conference on Data Mining \(ICDM\),pp\. 1102–1107\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p2.1)\.
- \[26\]Y\. Huang, G\. Yang, H\. Zhou, H\. Dai, D\. Yuan, and S\. Yu\(2024\)VPPFL: a verifiable privacy\-preserving federated learning scheme against poisoning attacks\.Computers & Security136,pp\. 103562\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.7.7.7.2)\.
- \[27\]W\. Jin, Y\. Yao, S\. Han, J\. Gu, C\. Joe\-Wong, S\. Ravi, S\. Avestimehr, and C\. He\(2023\)FedML\-he: an efficient homomorphic\-encryption\-based privacy\-preserving federated learning system\.arXiv preprint arXiv:2303\.10837\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p4.1)\.
- \[28\]H\. Kasyap and S\. Tripathy\(2024\)Sine: similarity is not enough for mitigating local model poisoning attacks in federated learning\.Transactions on Dependable and Secure Computing21\(5\),pp\. 4481–4494\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1)\.
- \[29\]T\. Krauß and A\. Dmitrienko\(2023\)Mesas: poisoning defense for federated learning resilient against adaptive attackers\.InACM SIGSAC Conference on Computer and Communications Security,pp\. 1526–1540\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p3.4),[§4\.4\.4](https://arxiv.org/html/2607.06612#S4.SS4.SSS4.p1.1),[§4\.4](https://arxiv.org/html/2607.06612#S4.SS4.p1.1)\.
- \[30\]A\. Krizhevsky, G\. Hinton,et al\.\(2009\)Learning multiple layers of features from tiny images\.Cited by:[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p4.1)\.
- \[31\]Y\. LeCun, B\. Boser, J\. S\. Denker, D\. Henderson, R\. E\. Howard, W\. Hubbard, and L\. D\. Jackel\(1989\)Backpropagation applied to handwritten zip code recognition\.Neural computation1\(4\),pp\. 541–551\.Cited by:[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p4.1)\.
- \[32\]J\. Liu, X\. Li, X\. Liu, H\. Zhang, Y\. Miao, and R\. H\. Deng\(2024\)DefendFL: a privacy\-preserving federated learning scheme against poisoning attacks\.IEEE Transactions on Neural Networks and Learning Systems\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.13.4.1)\.
- \[33\]S\. Liu, J\. Ren, R\. Meng, X\. Yan, Y\. Miao, Z\. Liu, J\. Peng, Y\. Zou, Z\. Wang, H\. Li,et al\.\(2025\)Secure and robust federated learning under dual\-server architecture in internet of things\.IEEE Internet of Things Journal\.Cited by:[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1)\.
- \[34\]J\. Ma, S\. Naas, S\. Sigg, and X\. Lyu\(2022\)Privacy\-preserving federated learning based on multi\-key homomorphic encryption\.International Journal of Intelligent Systems37\(9\),pp\. 5880–5901\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p4.1),[§2\.2](https://arxiv.org/html/2607.06612#S2.SS2.p1.1)\.
- \[35\]R\. Ma, K\. Hwang, M\. Li, and Y\. Miao\(2024\)Trusted model aggregation with zero\-knowledge proofs in federated learning\.IEEE Transactions on Parallel and Distributed Systems\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.16.7.1)\.
- \[36\]D\. Manna, H\. Kasyap, and S\. Tripathy\(2022\)Milsa: model interpretation based label sniffing attack in federated learning\.InInternational conference on information systems security,pp\. 139–154\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1)\.
- \[37\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InArtificial Intelligence and Statistics,pp\. 1273–1282\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1),[§2\.1](https://arxiv.org/html/2607.06612#S2.SS1.p4.1)\.
- \[38\]H\. B\. McMahan, E\. Moore, D\. Ramage, and B\. A\. y Arcas\(2016\)Federated learning of deep networks using model averaging\.CoRRabs/1602\.05629\.External Links:[Link](http://arxiv.org/abs/1602.05629),1602\.05629Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1),[§2\.1](https://arxiv.org/html/2607.06612#S2.SS1.p1.1)\.
- \[39\]V\. Mothukuri, R\. M\. Parizi, S\. Pouriyeh, Y\. Huang, A\. Dehghantanha, and G\. Srivastava\(2021\)A survey on security and privacy of federated learning\.Future Generation Computer Systems115,pp\. 619–640\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1)\.
- \[40\]M\. Nasr, R\. Shokri, and A\. Houmansadr\(2019\)Comprehensive privacy analysis of deep learning: passive and active white\-box inference attacks against centralized and federated learning\.InIEEE symposium on security and privacy \(SP\),pp\. 739–753\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1),[¶2\.1\.1\.2](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P2.p1.1)\.
- \[41\]T\. D\. Nguyen, P\. Rieger, H\. Chen, H\. Yalame, H\. Möllering, H\. Fereidooni, S\. Marchal, M\. Miettinen, A\. Mirhoseini, S\. Zeitouni,et al\.\(2022\)FLAME: taming backdoors in federated learning\.In31st USENIX Security Symposium,pp\. 1415–1432\.Cited by:[§4\.4\.4](https://arxiv.org/html/2607.06612#S4.SS4.SSS4.p1.1)\.
- \[42\]M\. Rathee, C\. Shen, S\. Wagh, and R\. A\. Popa\(2023\)Elsa: secure aggregation for federated learning with malicious actors\.InSymposium on Security and Privacy \(SP\),pp\. 1961–1979\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p2.1),[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.15.6.1),[§1](https://arxiv.org/html/2607.06612#S1.p2.1),[§6\.1\.2](https://arxiv.org/html/2607.06612#S6.SS1.SSS2.Px4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p8.1)\.
- \[43\]P\. Rieger, T\. Krauß, M\. Miettinen, A\. Dmitrienko, and A\. Sadeghi\(2022\)Crowdguard: federated backdoor detection in federated learning\.arXiv preprint arXiv:2210\.07714\.Cited by:[§4\.4\.4](https://arxiv.org/html/2607.06612#S4.SS4.SSS4.p1.1)\.
- \[44\]A\. Roy Chowdhury, C\. Guo, S\. Jha, and L\. van der Maaten\(2022\)Eiffel: ensuring integrity for federated learning\.InACM SIGSAC Conference on Computer and Communications Security,pp\. 2535–2549\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.19.10.1),[§1](https://arxiv.org/html/2607.06612#S1.p2.1)\.
- \[45\]A\. Shafahi, W\. R\. Huang, M\. Najibi, O\. Suciu, C\. Studer, T\. Dumitras, and T\. Goldstein\(2018\)Poison frogs\! targeted clean\-label poisoning attacks on neural networks\.InNeural Information Processing Systems,NIPS’18,pp\. 6106–6116\.Cited by:[¶2\.1\.1\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P1.p1.2)\.
- \[46\]V\. Shejwalkar and A\. Houmansadr\(2021\)Manipulating the byzantine: optimizing model poisoning attacks and defenses for federated learning\.InNDSS,Cited by:[¶2\.1\.1\.1](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P1.p1.2),[§6\.2\.5](https://arxiv.org/html/2607.06612#S6.SS2.SSS5.p1.1)\.
- \[47\]J\. Tang, H\. Xu, H\. Liao, and Y\. Zhou\(2025\)SeaFlame: communication\-efficient secure aggregation for federated learning against malicious entities\.IACR Transactions on Cryptographic Hardware and Embedded Systems2025\(2\),pp\. 69–93\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.12.3.1),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1)\.
- \[48\]J\. Tang, H\. Xu, M\. Wang, T\. Tang, C\. Peng, and H\. Liao\(2024\)A flexible and scalable malicious secure aggregation protocol for federated learning\.IEEE Transactions on Information Forensics and Security\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.9.9.18.9.1)\.
- \[49\]Z\. Tian, Y\. Ding, X\. Yu, E\. Gong, J\. Liu, and K\. Ren\(2025\)Towards collaborative anti\-money laundering among financial institutions\.InWeb Conference,pp\. 4722–4733\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1)\.
- \[50\]V\. Tolpegin, S\. Truex, M\. E\. Gursoy, and L\. Liu\(2020\)Data poisoning attacks against federated learning systems\.In25th European symposium on research in computer security,pp\. 480–501\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p1.1)\.
- \[51\]R\. Wang, X\. Wang, H\. Chen, J\. Decouchant, S\. Picek, N\. Laoutaris, and K\. Liang\(2024\)MUDGUARD: taming malicious majorities in federated learning using privacy\-preserving byzantine\-robust clustering\.ACM Conference on Measurement and Analysis of Computing Systems8\(3\),pp\. 1–41\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p2.1),[Table 1](https://arxiv.org/html/2607.06612#S1.T1.1.1.1.2),[§1](https://arxiv.org/html/2607.06612#S1.p2.1),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p2.1)\.
- \[52\]Z\. Wang, Z\. Chang, J\. Hu, X\. Pang, J\. Du, Y\. Chen, and K\. Ren\(2024\)Breaking secure aggregation: label leakage from aggregated gradients in federated learning\.InIEEE INFOCOM 2024\-IEEE Conference on Computer Communications,pp\. 151–160\.Cited by:[¶2\.1\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS1.P3.p1.1)\.
- \[53\]G\. Xu, H\. Li, S\. Liu, K\. Yang, and X\. Lin\(2019\)VerifyNet: secure and verifiable federated learning\.IEEE Transactions on Information Forensics and Security15,pp\. 911–926\.Cited by:[§1](https://arxiv.org/html/2607.06612#S1.p3.1)\.
- \[54\]R\. Xu, B\. Li, C\. Li, J\. B\. Joshi, S\. Ma, and J\. Li\(2024\)Tapfed: threshold secure aggregation for privacy\-preserving federated learning\.IEEE Transactions on Dependable and Secure Computing21\(5\),pp\. 4309–4323\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.3.3.3.2),[§2\.1\.3](https://arxiv.org/html/2607.06612#S2.SS1.SSS3.p1.1)\.
- \[55\]B\. Yin, H\. Zhang, J\. Lin, F\. Kong, and L\. Yu\(2024\)PVFL: verifiable federated learning and prediction with privacy\-preserving\.Computers & Security139,pp\. 103700\.Cited by:[Table 1](https://arxiv.org/html/2607.06612#S1.T1.6.6.6.2)\.
- \[56\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InInternational Conference on Machine Learning,pp\. 5650–5659\.Cited by:[§1\.1](https://arxiv.org/html/2607.06612#S1.SS1.p3.4),[¶2\.1\.2\.2](https://arxiv.org/html/2607.06612#S2.SS1.SSS2.P2.p1.1),[§4\.4](https://arxiv.org/html/2607.06612#S4.SS4.p1.1),[§6\.1\.3](https://arxiv.org/html/2607.06612#S6.SS1.SSS3.p7.1)\.

## Appendix APRoVeFL\-enabled MESAS \(Figure[10](https://arxiv.org/html/2607.06612#A1.F10)\)\.

MESAS is implemented underPRoVeFLby privately computing all statistical distances from perturbed client updates and performing the clustering and pruning in the plaintext domain\. Each server privately computes the following operations on encrypted, randomly masked client updates: cosine similarity, Euclidean distance, count, min\-max, and variance\. After collaborative decryption, the servers obtain only obfuscated metric values, which preserve relative ordering\. MESAS then applies its statistical tests to identify significant deviations, followed by clustering to separate benign and malicious client updates\.

Input:•Each serverkkreceives a set ofnnencrypted client updates\{ci,k=Enc𝗉𝗄⁡\(r⋅ui,k\):i=1,2,…,n\}\\\{c\_\{i,k\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot u\_\{i,k\}\\right\):i=1,2,\\dots,n\\\}, whereui​ku\_\{ik\}iskt​hk^\{th\}subset of client update of clienti\.•Additionally receives encrypted norm and mean\{ei=Enc𝗉𝗄⁡\(r‖ui‖\):i=1,2,…,n\},Enc𝗉𝗄⁡\(r⋅μi\)\.\\\{e\_\{i\}=\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\\frac\{r\}\{\\\|u\_\{i\}\\\|\}\\right\):i=1,2,\\dots,n\\\},\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(r\\cdot\\mu\_\{i\}\\right\)\.\[Note \- Both encrypted norm and mean can also be calculated privately at the server side\.\]•Server Update Vector:u0,‖u0‖u\_\{0\},\\\|u\_\{0\}\\\|Server\-Side Encrypted Operations1\.Coordinate\-wise products\[Cosine Similarity\]\.For each clientiiEnc𝗉𝗄⁡\(c​o​si\)=u0⊙ci,k‖u0‖⋅Enc𝗉𝗄⁡\(r‖ui‖\)\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\(cos\_\{i\}\)\\;=\\;\\frac\{u\_\{0\}\\odot c\_\{i,k\}\}\{\\\|u\_\{0\}\\\|\\cdot\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(\\frac\{r\}\{\\\|u\_\{i\}\\\|\}\\right\)\}2\.Compute\(Euclidean distance\)Enc𝗉𝗄⁡\(e​u​ci\)=\(ci,k−u0,k\)2\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(euc\_\{i\}\\right\)=\(c\_\{i,k\}\-u\_\{0,k\}\)^\{2\}\.3\.Find\(Pairwise distance \- Min/Max/COUNT\)Enc𝗉𝗄⁡\(c​o​u​n​ti\)=\(ci,k−u0,k\)\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(count\_\{i\}\\right\)=\(c\_\{i,k\}\-u\_\{0,k\}\)\.4\.Calculate\(Variance\)Enc𝗉𝗄⁡\(v​a​ri\)=\(ci,k−r⋅μi\)\.\\operatorname\{Enc\}\_\{\\mathsf\{pk\}\}\\left\(var\_\{i\}\\right\)=\(c\_\{i,k\}\-r\\cdot\\mu\_\{i\}\)\.5\.Collaborative decryption\.Decrypt to obtainc​o​sicos\_\{i\},e​u​cieuc\_\{i\},c​o​u​n​ticount\_\{i\},v​a​rivar\_\{i\}\.Verification of Correct Computation\.6\.Servers publishe​\(g0,g0\)di​j,kle\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{l\}\}\}as a proof for the correct computation, for alldi∈\{cosid\_\{i\}\\in\\\{cos\_\{i\},e​u​cieuc\_\{i\},c​o​u​n​ticount\_\{i\},vari\}var\_\{i\}\\\}\.7\.Peer Servers: For every coordinateℓ\\elland pair\(i,j\)\(i,j\)verify,e​\(hi​kℓ​\(hj​kℓ\)−1,hi​kℓ​\(hj​kℓ\)−1\)=?e​\(g0,g0\)di​j,kl\.e\(h\_\{ik\_\{\\ell\}\}\(h\_\{jk\_\{\\ell\}\}\)^\{\-1\},h\_\{ik\_\{\\ell\}\}\(h\_\{jk\_\{\\ell\}\}\)^\{\-1\}\)\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}e\(g\_\{0\},g\_\{0\}\)^\{d\_\{ij,k\_\{l\}\}\}\.8\.Abort on the first mismatch\.Plaintext operations9\.Euclidean and cosine distances:Now, one of the servers \(assuming at least one is honest\) compute the total Euclidean and cosine distance\. The distances are scaled up byrr\. However, they preserve order, which is sufficient\.10\.Min/Max/COUNT:From all the decrypted count vectors, Min and Max can be calculated\. Further, we can prepare a binary sign vectors​g​nsgn, such thats​g​nl=\{0,if​ui,kl≤u0,kl1,otherwisesgn\_\{l\}=\\begin\{cases\}0,&\\text\{if \}u\_\{i,k\_\{l\}\}\\leq u\_\{0,k\_\{l\}\}\\\\ 1,&\\text\{otherwise\}\\end\{cases\}\. Sum of sgn gives COUNT that how many parameter values have increased from the respective parameter of the previous global model\.11\.Selection:This step can be computed same as in plaintext, perform pruning based on clustering, and selecting the next global model update\.

Figure 10:Instantiation of MESAS inPRoVeFL
## Appendix BInput\-Phase Confidentiality

###### Theorem 1\.

The pre\-processing view𝗏𝗂𝖾𝗐kpre\\mathsf\{view\}^\{\\mathrm\{pre\}\}\_\{k\}held by any single PPT server is computationally indistinguishable from a view with uniformly random ciphertexts\. Consequently, the server learns nothing about individual client updates beyond public\-size metadata\.

###### Proof\.

IND\-CPA security \(decisional Ring\-LWE\) makes\(ci,1,ci,2\)\(c\_\{i,1\},c\_\{i,2\}\)indistinguishable from encryptions of uniform vectors\. Commitmentshi,kℓ=gui,kℓh\_\{i,k\_\{\\ell\}\}=g^\{u\_\{i,k\_\{\\ell\}\}\}reveal no message information under DLP hardness\. A simulator that replaces each ciphertext by an encryption of a uniform vector produces a view that is indistinguishable from the real execution, establishing the claim\. ∎

## Appendix CPost\-Decryption Privacy

###### Theorem 2\.

For any probabilistic polynomial\-time adversary controlling a single server, the distribution of\{di\}\\\{d\_\{i\}\\\}is computationally indistinguishable from uniform; the adversary therefore gains no non\-negligible information about the underlying plaintext updates beyond the masked vectorsdid\_\{i\}\.

###### Proof\.

The global maskr​←$​ℤp×r\\overset\{\\mathdollar\}\{\\leftarrow\}\\mathbb\{Z\}\_\{p\}^\{\\times\}is from a uniform distribution and remains secret from every individual server\. Fix an arbitrary probabilistic polynomial\-time adversary𝒜\\mathcal\{A\}that corrupts𝒮1\\mathcal\{S\}\_\{1\}and let𝗏𝗂𝖾𝗐1post\\mathsf\{view\}^\{\\mathrm\{post\}\}\_\{1\}denote the adversary’s entire view, including the set\{di\}i=1n\\\{d\_\{i\}\\\}\_\{i=1\}^\{n\}obtained after collaborative decryption\.

Hybrid argument\.We build a sequence of hybridsℋ0,ℋ1\\mathcal\{H\}\_\{0\},\\mathcal\{H\}\_\{1\}and show that𝒜\\mathcal\{A\}cannot distinguish them\.

- ℋ0\\mathcal\{H\}\_\{0\}The*real*execution outputting the true masked statisticsdid\_\{i\}computed as specified below\.
- ℋ1\\mathcal\{H\}\_\{1\}Identical toℋ0\\mathcal\{H\}\_\{0\}except that the simulator samples a freshr′​←$​ℤp×r^\{\\prime\}\\overset\{\\mathdollar\}\{\\leftarrow\}\\mathbb\{Z\}\_\{p\}^\{\\times\}independent of all protocol messages and replaces everydid\_\{i\}bydi′←f​\(r′,si\)d\_\{i\}^\{\\prime\}\\leftarrow f\(r^\{\\prime\},s\_\{i\}\), where the masking functionffis chosen per aggregation rule: f​\(r′,si\)=\{r′⁣2​siKrumr′​siTrimmed\-Meanr′​ut⊙ui,kFLTrust\.f\(r^\{\\prime\},s\_\{i\}\)=\\begin\{cases\}r^\{\\prime 2\}\\,s\_\{i\}&\\text\{Krum\}\\\\\[4\.0pt\] r^\{\\prime\}\\,s\_\{i\}&\\text\{Trimmed\-Mean\}\\\\\[4\.0pt\] r^\{\\prime\}\\,u\_\{t\}\\odot u\_\{i,k\}&\\text\{FLTrust\}\.\\end\{cases\}

Indistinguishability of hybrids\.For each rule we argue that𝗏𝗂𝖾𝗐1post​\(ℋ0\)\\mathsf\{view\}^\{\\mathrm\{post\}\}\_\{1\}\(\\mathcal\{H\}\_\{0\}\)and𝗏𝗂𝖾𝗐1post​\(ℋ1\)\\mathsf\{view\}^\{\\mathrm\{post\}\}\_\{1\}\(\\mathcal\{H\}\_\{1\}\)are computationally indistinguishable:

Krum\.Coordinates take the formdi​j,kj=r2​Δi​j,kj2d\_\{ij,k\_\{j\}\}=r^\{2\}\\,\\Delta\_\{ij,k\_\{j\}\}^\{2\}withΔi​j,kj≠0\\Delta\_\{ij,k\_\{j\}\}\\neq 0except with negligible probability\. Becauserris uniform non\-zero,r2r^\{2\}is uniform over the quadratic residues modulopp\. The set of squares forms a subgroup of index 2, whencer2​Δ2r^\{2\}\\,\\Delta^\{2\}is uniform over the same subgroup in both hybrids; the distributions coincide\.

Trimmed\-Mean\.For any fixed non\-zero coordinatesi,j=ui,kj−uj,kjs\_\{i,j\}=u\_\{i,k\_\{j\}\}\-u\_\{j,k\_\{j\}\}, the productr​si,jr\\,s\_\{i,j\}is uniform inℤp\\mathbb\{Z\}\_\{p\}becauserris uniform inℤp×\\mathbb\{Z\}\_\{p\}^\{\\times\}\. Whensi,j=0s\_\{i,j\}=0the value is identically 0 in both hybrids, which occurs with probability1/p1/pand is therefore negligible\. Thus every coordinate ofdid\_\{i\}is identically distributed in the two hybrids\.

FLTrust\.Each coordinate isdi,j=r​ut,j​ui,kjd\_\{i,j\}=r\\,u\_\{t,j\}\\,u\_\{i,k\_\{j\}\}\. The known constantut,ju\_\{t,j\}is non\-zero with overwhelming probability, sor​ut,jr\\,u\_\{t,j\}is again uniform overℤp×\\mathbb\{Z\}\_\{p\}^\{\\times\}\. Multiplying byui,kju\_\{i,k\_\{j\}\}therefore yields a uniform coordinate unlessui,kj=0u\_\{i,k\_\{j\}\}=0, which happens with negligible probability\.

Simulation\.Inℋ1\\mathcal\{H\}\_\{1\}the simulator need not know the plaintext updates: it drawsr′r^\{\\prime\}and outputs independent random vectors of the correct dimensionality\. Thereforeℋ1\\mathcal\{H\}\_\{1\}can be generated without access to any client secret, and𝒜\\mathcal\{A\}’s distinguishing advantage betweenℋ0\\mathcal\{H\}\_\{0\}andℋ1\\mathcal\{H\}\_\{1\}is negligible\.

Conclusion\.Sinceℋ1\\mathcal\{H\}\_\{1\}is independent of the underlying plaintext updates, the adversary extracts no non\-negligible information from\{di\}\\\{d\_\{i\}\\\}\. ∎

## Appendix DAggregation integrity

00\.10\.10\.20\.20\.30\.30\.40\.40\.50\.50\.60\.60\.70\.70\.80\.80\.90\.91110S4S2STime \(s\)ClientsL2L\_\{2\}normClientServer\-EncServer\-Plain01122334455667788991010111110S4S2STime \(s\)Krum010102020303040405050606010S4S2STime \(s\)ClientsTrimmed Mean00\.50\.5111\.51\.5222\.52\.5333\.53\.5444\.54\.55510S4S2STime \(s\)FLTrust
Figure 11:Runtime breakdown across different Byzantine\-robust aggregation methods and servers \(50 clients, 100k params\)\.00\.20\.20\.40\.40\.60\.60\.80\.8111\.21\.21\.41\.41\.61\.61\.81\.810S4S2STime \(s\)ClientsL2L\_\{2\}normClientServer\-EncServer\-Plain0202040406060808010010012012014014016016018018010S4S2STime \(s\)Krum0202040406060808010010012012014014016016010S4S2STime \(s\)ClientsTrimmed Mean0112233445566778899101010S4S2STime \(s\)FLTrust
Figure 12:Runtime breakdown across different Byzantine\-robust aggregation methods and server \(100 clients, 100k params\)\.###### Theorem 3\.

Any probabilistic polynomial\-time \(PPT\) adversary𝒜\\mathcal\{A\}that corrupts a single aggregation server, can convince the honest server to accept an aggregate vectordi,jk′≠di,jkd^\{\\prime\}\_\{i,j\_\{k\}\}\\neq d\_\{i,j\_\{k\}\}\(wheredi,jkd\_\{i,j\_\{k\}\}is the actual computed intermediate aggregation vectorKrum, Trimmed\-Mean, or FLTrust as applicable\) only with negligible probability\.

###### Proof\.

Assume a PPT adversary𝒜\\mathcal\{A\}controls server𝒮1\\mathcal\{S\}\_\{1\}and causes the honest server𝒮2\\mathcal\{S\}\_\{2\}to accept an incorrect vectord′≠dd^\{\\prime\}\\neq dwith non\-negligible probabilityε​\(λ\)\\varepsilon\(\\lambda\)\. We build a reductionℬ\\mathcal\{B\}breaking the discrete logarithm \(DL\) problem in𝔾\\mathbb\{G\}\.

Hybrid embedding\.Given a DL instance\(g0,g0x\)\(g\_\{0\},g\_\{0\}^\{x\}\),ℬ\\mathcal\{B\}selects a random coordinateℓ⋆\\ell^\{\\star\}, embedsg0xg\_\{0\}^\{x\}into the proof element that𝒮1\\mathcal\{S\}\_\{1\}must output for that coordinate, and generates all other protocol values honestly\. Specifically, the expected proof in each method is replaced as follows:

Forgery implies DL solution\.If𝒜\\mathcal\{A\}forges a vectord′d^\{\\prime\}that differs fromddinℓ⋆\\ell^\{\\star\}yet passes the verification test, the following relations hold:

Krum:e​\(hi​hj−1,hi​hj−1\)=e​\(g0,g0\)x,\\displaystyle e\(h\_\{i\}h\_\{j\}^\{\-1\},h\_\{i\}h\_\{j\}^\{\-1\}\)=e\(g\_\{0\},g\_\{0\}\)^\{x\},Trimmed:hi​hj−1=g0x,\\displaystyle h\_\{i\}h\_\{j\}^\{\-1\}=g\_\{0\}^\{x\},FLTrust:hiut,ℓ⋆=g0x,\\displaystyle h\_\{i\}^\{u\_\{t,\\ell^\{\\star\}\}\}=g\_\{0\}^\{x\},wherehi=gui,ℓ⋆=g0r​ui,ℓ⋆h\_\{i\}=g^\{u\_\{i,\\ell^\{\\star\}\}\}=g\_\{0\}^\{ru\_\{i,\\ell^\{\\star\}\}\}\. Bilinearity \(or plain exponent algebra\) yieldsx=\{r2​Δ2Krumr​ΔTrimmed\-Meanr​ut,ℓ⋆FLTrust,x=\\begin\{cases\}r^\{2\}\\Delta^\{2\}&\\text\{Krum\}\\\\ r\\Delta&\\text\{Trimmed\-Mean\}\\\\ r\\,u\_\{t,\\ell^\{\\star\}\}&\\text\{FLTrust\},\\end\{cases\}withΔ=ui,ℓ⋆−uj,ℓ⋆≠0\\Delta=u\_\{i,\\ell^\{\\star\}\}\-u\_\{j,\\ell^\{\\star\}\}\\neq 0except with probability1/p1/p\. BecauseΔ\\Deltaandut,ℓ⋆u\_\{t,\\ell^\{\\star\}\}are non\-zero and publicly known,ℬ\\mathcal\{B\}inverts the multiplicative constant and outputsxx, solving DL whenever the forgery occurs\.

Extraction via the decrypted valuedid\_\{i\}\.After the collaborative decryption step each intermediate statisticdi​j,kℓd\_\{ij,k\_\{\\ell\}\}is revealed to both servers in*plaintext*form\. Hence the reductionℬ\\mathcal\{B\}can read the forged entrydi​j,kℓ⋆′d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}directly\. From the verification equation that𝒜\\mathcal\{A\}caused to hold we obtain, for the special coordinateℓ⋆\\ell^\{\\star\},

x=\{di​j,kℓ⋆′Krum, since​di​j,kℓ⋆′=r2​Δ2,di​j,kℓ⋆′Trimmed\-Mean, where​di​j,kℓ⋆′=r​Δ,di,ℓ⋆′ut,ℓ⋆FLTrust, with​di,ℓ⋆′=r​ut,ℓ⋆\.x=\\begin\{cases\}d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}&\\text\{Krum, since \}d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}=r^\{2\}\\Delta^\{2\},\\\\\[4\.0pt\] d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}&\\text\{Trimmed\-Mean, where \}d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}=r\\Delta,\\\\\[4\.0pt\] \\displaystyle\\frac\{d^\{\\prime\}\_\{i,\\ell^\{\\star\}\}\}\{u\_\{t,\\ell^\{\\star\}\}\}&\\text\{FLTrust, with \}d^\{\\prime\}\_\{i,\\ell^\{\\star\}\}=r\\,u\_\{t,\\ell^\{\\star\}\}\.\\end\{cases\}
HereΔ=ui,ℓ⋆−uj,ℓ⋆≠0\\Delta=u\_\{i,\\ell^\{\\star\}\}\-u\_\{j,\\ell^\{\\star\}\}\\neq 0except with probability1/p1/p\. Becauserris uniform inℤp×\\mathbb\{Z\}\_\{p\}^\{\\times\}and never revealed,di​j,kℓ⋆′d^\{\\prime\}\_\{ij,k\_\{\\ell^\{\\star\}\}\}is a non\-zero multiple ofxxchosen uniformly at random, and the multiplier \(r2​Δ2r^\{2\}\\Delta^\{2\},r​Δr\\Delta, orr​ut,ℓ⋆r\\,u\_\{t,\\ell^\{\\star\}\}\) is invertible with overwhelming probability\.ℬ\\mathcal\{B\}therefore recoversxxby a single modular division, solving the discrete\-log instance whenever the forgery occurs\.

Success probability\.The reduction fails only when the chosen coordinate isΔ=0\\Delta=0\(orut,ℓ⋆=0u\_\{t,\\ell^\{\\star\}\}=0for FLTrust\), an event of probability at most1/p1/p\. Thusℬ\\mathcal\{B\}solves the DL with probability at leastε​\(λ\)/N−n​e​g​l​\(λ\)\\varepsilon\(\\lambda\)/N\-negl\(\\lambda\), contradicting DL hardness\. Consequently, a corrupt server can cause acceptance ofdi​j,k′≠di​j,kd^\{\\prime\}\_\{ij,k\}\\neq d\_\{ij,k\}only with negligible probability\.

∎

## Appendix ERuntime Breakdown

Figures[11](https://arxiv.org/html/2607.06612#A4.F11)and[12](https://arxiv.org/html/2607.06612#A4.F12)present a runtime breakdown of server \(Plaintext vs\. Encrypted\) and client inPRoVeFL\-tailored schemes, with different numbers of server \(2, 4 and 10\) and client \(50 and 100 clients\)\. Each bar is divided into three components: \(i\) Client computation, \(ii\) Encrypted server\-side computation, and \(iii\) Plaintext \(or Plaintext\-Ciphertext\) server\-side computation\.

Client Computation is consistently lightweight\. For all aggregation methods and client counts, the client\-side computation remains at 0\.18s with 2 servers\. It is 0\.25s for 10 servers, because the client needs to encrypt more packets\. Overall, the client\-side overhead does not scale significantly with the number of clients or the choice of aggregation\. For 100 clients, Krum requires more than 100s on the server, indicating a drastic increase in encrypted computation due to its pairwise distance computations\. For Trimmed\-mean, encrypted computation time increases with the number of clients, rising from 14s \(50 clients\) to 161s \(100 clients\), because the number of pairwise comparisons increases\. However, Trimmed\-mean improves by big margins after increasing the number of servers\. FLTrust shows moderate runtime overheads under encryption and remains efficient even with 100 clients\.