Research map / Federated learning and privacy / Privacy attacks and secure learning

Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning

ICML 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Private federated aggregation

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Janus, a dual-server multi-round secure aggregation scheme for federated learning that adds verifiability via a new separable homomorphic commitment and resists model inconsistency attacks.

Problem

Existing secure aggregation for federated learning (notably Flamingo) lacks efficient support for dynamic user participation, cannot verify server-side aggregation results, and is vulnerable to model inconsistency attacks from a malicious single server.

Approach

Split aggregation across two non-colluding servers: one aggregates OTP-masked updates, the other aggregates encrypted masking keys and commitments; a new separable homomorphic commitment lets clients verify the aggregate while neither server sees the final aggregation result, blocking model inconsistency attacks and avoiding pairwise key negotiation.

Key results

• On MNIST with CNN, No-SA reaches 94.1% test accuracy while Janus reaches 93.18%; with MLP, 85.04% vs 83.95%.
• On CIFAR with CNN, No-SA 77.8% vs Janus 75.94%; with MLP, 72.8% vs 71.6%.
• Janus reduces per-client computation and communication from O(log n) (BBSA/Flamingo-style) to O(1), per the asymptotic analysis.

Measured effects reported in the paper

Limitations

• Server-side computation and communication still scale linearly with the number of clients O(n).
• Verifiability and dual-server security depend on the assumption that the two servers do not collude.
• Accuracy drops relative to No-SA baseline (e.g., about 1.2 points on MNIST CNN) and experiments are limited to small models on MNIST/CIFAR.

Experimental setup

Datasets: MNIST CIFAR-10 CIFAR-100

Benchmarks: MNIST CIFAR-10 CIFAR-100

Metrics: test accuracy running time per client running time per server communication overhead (asymptotic)

Baselines: No-SA FedAvg BBSA VeriFL ELSA Flamingo SecAgg

Builds on: Flamingo BBSA VeriFL Pedersen commitment

Closest papers by meaning

• Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.87)
• Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.87)
• FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.87)
• RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation (NeurIPS 2024 · similarity 0.87)
• Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.87)
• Self-Driven Entropy Aggregation for Byzantine-Robust Heterogeneous Federated Learning (ICML 2024 · similarity 0.86)