Research map / Federated learning and privacy / Privacy attacks and secure learning
AegisFL: Efficient and Flexible Privacy-Preserving Byzantine-Robust Cross-silo Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AegisFL, a privacy-preserving Byzantine-robust cross-silo FL system using an RLWE-based (CKKS) packing scheme that computes inner products, L2 norms and means with one ciphertext multiplication, allowing flexible choice of robust aggregation rule while hiding the final model from the server.
Problem
Existing homomorphic-encryption-based privacy-preserving Byzantine-robust FL is inefficient, tied to a single robust aggregation rule (AGR), and exposes the final model to the server, violating cross-silo requirements.
Approach
A polynomial packing scheme over RLWE-based CKKS that encodes vectors so that inner products, L2 norms and mean values come out as constant terms of one polynomial multiplication, enabling many similarity-based AGRs (ShieldFL, FLAME-style, FLTrust-style, FheFL-style) to be built flexibly over ciphertexts, with the global model encrypted under client keys via a two-server key conversion.
Key results
- Hmm
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AegisFL's packing approach instead of original CKKS | Computing inner products · HAR | time cost (ms): 577 -> 24 | Helped |
| Use AegisFL's packing approach instead of original CKKS | Computing L2 norms · HAR | time cost (ms): 577 -> 24 | Helped |
| Use AegisFL's packing approach instead of original CKKS | Computing mean values · HAR | time cost (ms): 526 -> 18 | Helped |
| Use AegisFL's packing approach instead of original CKKS | Computing inner products · MNIST | time cost (ms): 797 -> 34 | Helped |
| Use AegisFL's packing approach instead of original CKKS | Computing L2 norms · MNIST | time cost (ms): 797 -> 34 | Helped |
| Use AegisFL's packing approach instead of original CKKS | Computing mean values · MNIST | time cost (ms): 727 -> 23 | Helped |
| Use AegisFL instead of ShieldFL | Cross-silo FL communication · HAR | traffic (MB): 35.5 -> 7.03 | Helped |
| Use AegisFL instead of Original CKKS | Cross-silo FL communication · HAR | traffic (MB): 7.03 -> 7.03 | No clear effect |
| Use AegisFL instead of ShieldFL | Cross-silo FL communication · MNIST | traffic (MB): 49.69 -> 10.16 | Helped |
| Use AegisFL instead of Original CKKS | Cross-silo FL communication · MNIST | traffic (MB): 9.77 -> 10.16 | Hurt |
Surprising findings
- ShieldFL is less effective than M-FLAME against scaling attacks on HAR, while M-FLAME is more effective on MNIST, showing no single AGR dominates across settings.
Limitations
- Incompatible with statistics-based (e.g., coordinate-wise median, trimmed mean) and feature-extraction-based AGRs under CKKS.
- Experiments use a simple fully connected network and only two datasets on a single PC.
- Modified FLAME clipping formula is a heuristic change without formal analysis of its robustness.
Experimental setup
Datasets: HAR MNIST
Benchmarks: HAR MNIST
Metrics: accuracy time cost (ms) communication traffic (MB)
Baselines: FedAvg ShieldFL original CKKS packing (Miao et al., 2022) M-FLAME
Builds on: CKKS ShieldFL FLAME FLTrust FheFL
Closest papers by meaning
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.86)
- RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation (NeurIPS 2024 · similarity 0.85)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.85)
- Certifiably Byzantine-Robust Federated Conformal Prediction (ICML 2024 · similarity 0.85)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.85)
- Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.