VeriTrac: Verifiable and traceable cross-silo federated learning

Abstract

Cross-silo federated learning enables many clients to train a machine learning model collaboratively, while keeping the raw training data locally. It faces the risks of privacy leakage and malicious participants. In this paper, we introduce a new security risk that malicious clients may disrupt the training process of cross-silo federated learning by falsifying the verification evidences. The verification failure caused by this malicious behavior is not easily distinguishable from that caused by the malicious server falsifying the aggregated model. To address this issue, we design VeriTrac, the first privacy-preserving cross-silo federated learning scheme that supports verifiability and traceability. Before performing the aggregation, the server can utilize the non-private information of clients to verify messages submitted by them to avoid being framed. When the proportion of malicious clients is less than 50%, malicious participants causing the verification error can be traced. In addition, to verify the correctness of the aggregated models, a model vector with a verification factor is constructed and encrypted. The vector is confidential for the server, and the factor is part of the verification evidence and recoverable for clients. Security analysis shows that VeriTrac can guarantee the tracing of malicious participants and the data security of clients. Experimental evaluation shows that computation efficiency and communication efficiency of VeriTrac are acceptable.