While Secure Aggregation (SA) protects update confidentiality in Cross-silo Federated Learning, it fails to guarantee aggregation integrity, allowing malicious servers to silently omit or tamper with updates. Existing verifiable aggregation schemes rely on heavyweight cryptography (e.g., ZKPs, HE), incurring computational costs that scale poorly with model size. In this paper, we propose a lightweight architecture that shifts from extrinsic cryptographic proofs to Intrinsic Proofs. We repurpose backdoor injection to embed verification signals directly into model parameters. By harnessing Catastrophic Forgetting, these signals are robust for immediate verification yet ephemeral, naturally decaying to preserve final model utility. We design a randomized, single-verifier auditing framework compatible with SA, ensuring client anonymity and preventing signal collision without trusted third parties. Experiments on SVHN, CIFAR-10, and CIFAR-100 demonstrate high detection probabilities against malicious servers. Notably, our approach achieves over 1000× speedup on ResNet-18 compared to cryptographic baselines, effectively scaling to large models.
Figures & tables
Figure 1: Overview of the proposed verifiable aggregation scheme. In each round, a randomized client is secretly designated as the verifier to embed a Intrinsic Proof into its local update. After aggregation, this verifier checks for the corresponding behavioral response in the global model to confirm honest aggregation.
Figure 2: Clean accuracy comparison.
Figure 3: ASR under honest aggregation.
Figure 4: ASR when the server omits the verifier’s gradient every 10 rounds; yellow lines mark omissions.
Figure 5: ASR when the server omits the verifier’s gradient in 50 random rounds (with ρ=0.1 , T=100 ).
Figure 6: ASR Heatmap of Client 0’s local model across different trigger sets.
Figure 7: ASR Heatmap of global model accross different trigger sets: Every 10 rounds the server omits the verifier’s gradient
Dataset
Metric / Phase
LightVeriFL
Yang et al.
Ours
ResNet-20 (CIFAR-10)
Proof Gen. (s)
36.48
88.66
0.35
Verification (s)
0.80
0.32
0.04
Proof Comp. (s)
1.28
185.34
N/A
Total Time (s)
38.56
274.32
0.39
MobileNet-V1 (SVHN)
Proof Gen. (s)
492.22
700.55
0.37
Verification (s)
10.05
0.88
0.30
Table 1: Efficiency comparison across different models. Computation times are in seconds per round. “Proof Gen.” corresponds to “Intrinsic Proof Injection” for our method. “Proof Comp.” corresponds to extrinsic proof composition. “N/A” indicates the step is not applicable or incurs zero extra cost beyond standard FL. The symbol “–” denotes unfinished results due to equipment limits.
Federated learning aggregation combines client updates into shared or personalized models while balancing data heterogeneity, robustness, privacy, and communication.