Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning

Xinyun Liu; Zhi Lu; Yu Chen; Ronghua Xu

cs.CRAug 20, 2026

Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning

Authors: Xinyun Liu, Zhi Lu, Yu Chen, Ronghua Xu

Organizations: Department of Applied Computing, Michigan Technological University, Houghton, MI 49931, USA · School of Computing, National University of Singapore, Singapore, 119077, Singapore · Department of Electrical and Computer Engineering, Binghamton University, Binghamton, NY 13902, USA

Abstract

Federated learning (FL) is vulnerable to multi-level attacks. However, existing methods address them separately, leaving FL exposed to data leakage, unauthorized reuse, and malicious gradient manipulation. In this work, we propose an FL framework that couples keyed context-provenance watermarking with verifiable lattice-based secure aggregation of Real-World Anchored Watermarking and Lattice-Based Zero-Knowledge Secure Aggregation. At the data layer, we propose a Kerckhoffs-compliant scheme that utilizes Physical Anchor Metadata (PAM) to ensure data provenance. PAM is defined as a context-provenance token derived from trusted infrastructure data (time, location, and server ID) and then subjected to a keyed HMAC-SHA-256 transformation to produce a watermark payload that cannot be generated without the client's secret key. We further design FMGAN, a GAN-based robust image watermarking framework that embeds this transformed payload using a feature fusion module and a Mamba-guided linear attention mechanism. At the computation layer, we adopt a lattice-based zero-knowledge secure aggregation (LZKSA) protocol that verifies key correctness, L2 norm bounds, and cosine similarity constraints over committed gradients without revealing private updates. The RLWE-based design guarantees post-quantum security. Extensive experiments validate the complementary protection of the two layers under composite attack scenarios. To our knowledge, no prior verification workflow has jointly evaluated both layers in a hybrid, end-to-end trustworthy FL framework.

Figures & tables

Fig. 2: DEMA Infrastructure and PAM Data Structure.

Fig. 3: Architecture of FMGAN and its Encoder. The encoder includes (1) a Feature-Fusion Module (FFM) and (2) a Mamba-Guided Linear Attention Module (MGLA), which leverages linear attention to embed watermarks into low-saliency regions of the original image.

Fig. 4: Overview of the MGLA architectural design.

Model	$w=30$		$w=64$
	PSNR	SSIM	PSNR	SSIM
HiDDeN [ 50 ]	32.03	0.9143	31.93	0.9137
MBRS [ 22 ]	33.29	0.9022	33.03	0.9025
ReDMark [ 1 ]	37.64	0.9681	37.26	0.9678
FMGAN	41.75	0.9903	41.59	0.9902

TABLE I: Comparison of different models on the COCO dataset.

Fig. 5: Watermarking performance of FMGAN. (a) Original images. (b) Attention masks. (c) Watermarked images.

Attack	Parameter	HiDDeN (%)	FMGAN (%)
			$w=30$	$w=64$
Gaussian Noise	0.001	83.14	100.00	100.00
	0.05	80.36	98.19	99.39
	0.10	76.55	96.37	97.95
JPEG	QF=10	73.69	94.46	96.79
	QF=50	76.72	98.55	98.04

TABLE II: Robustness evaluation of the proposed FMGAN model under various attacks.

	Invisibility		Robustness (%)
Model	PSNR	SSIM	JPEG	Cropout	Dropout	Crop	Gauss.
	(dB)		(50)	(30%)	(30%)	(3.5%)	(2.0)
ReDMark [ 1 ]	38.94	0.9673	74.62	92.57	91.98	100.00	50.23
DA [ 36 ]	33.75	0.8702	81.75	91.01	97.93	93.56	60.08
TSDL [ 31 ]	33.53	0.8931	76.24	96.59	97.41	89.04	98.61
MBRS [ 22 ]	35.79	0.8896	91.94	99.98	99.96	92.69	100.00

TABLE III: Comparison of different models on the COCO dataset.

	Invisibility		Robustness (%)
Model	PSNR	SSIM	JPEG	Cropout	Dropout	Crop	Gauss.
	(dB)		(50)	(30%)	(30%)	(3.5%)	(2.0)
HiDDeN [ 50 ]	33.28	0.9105	76.42	95.87	95.43	96.04	88.69
DA [ 36 ]	34.08	0.8721	81.56	91.06	97.85	93.47	60.02
TSDL [ 31 ]	33.42	0.8906	76.63	96.41	97.28	89.11	98.57
MBRS [ 22 ]	37.06	0.8914	91.85	99.96	99.92	92.57	99.15

TABLE IV: Comparison of different models on the ImageNet-10 dataset.

Fig. 6: Watermark Removal Attack. (a) Watermarked images. (b) Watermark-removed images. The red dashed boxes highlight visually noticeable differences.

Fig. 7: Left: Per-client computation time comparison of the LZKSA protocols and SA. Right: Server-side computation time across different datasets. Both plots are obtained with 50 clients. A–E denote MNIST (19k), CIFAR-10 S (62k), CIFAR-10 L (273k), Shakespeare (818k), and ImageNet-10 (11181k), respectively.

Dataset Replacement (10% Replaced)
Metric	Replaced Images	Watermarked Images		Overall
Number of Images	100	900		1000
Detection Rate	100%	–		100%
FPR	–	0%		0%
Gradient Scaling
Metric	$B=0.5$	$B=1.0$	$B=1.5$	$B=5.0$

TABLE V: Detection Performance under Dataset Replacement and Gradient Scaling (Attack I)

	No defense	FMGAN only	LZKSA only	Dual-layer framework
Unauthorized samples detected	0%	100%	0%	100%
Malicious updates accepted	100%	100%	4%-5%	4%-5%

TABLE VI: System Performance under Attack I

Forged Data Injection (10% Injected)
Metric	Injected Images	Watermarked Images		Overall
Number of Images	100	1000		1100
Detection Rate	100%	–		100%
FPR	–	0%		0%
Directional Gradient Manipulation
Metric	$\alpha=0$	$\alpha=0.5$	$\alpha=0.8$	$\alpha=1.0$

TABLE VII: Detection Performance under Forged Data Injection and Directional Gradient Manipulation (Attack II)

Panel of Figure 15 — Fig. 8: Robustness evaluation under multiple intensity levels of trained noises. (a) Crop, (b) Dropout, (c) Gaussian blur, (d) Resize, (e) JPEG compression, (f) JPEG (Q=50) + Gaussian blur.

Dataset	Orig. FL	Proposed scheme
Dataset	Orig. FL	WM	ZK 2	ZK ∞	ZK ${}_{\text{cos}}$	Full
MNIST-0.5	96.3%	96.1%	96.2%	96.2%	96.1%	96.1%
CIFAR-10	83.8%	83.6%	83.7%	83.6%	83.5%	83.4%

TABLE VIII: Utility impact of the proposed scheme on the original FL task. The Watermark column reports test accuracy when clients train on watermarked images; the remaining columns report accuracy after enabling each private validation component.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 923 papers

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning
Jul 7, 2026Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca +2Federated Learning Aggregation Byzantine-Robust Federated Learning
Indian Institute of Technology (BHU), Varanasi, India · University of Warwick, Coventry, UK · Vaulttree,, Ireland +2
FedOT: Ownership Verification and Leakage Tracing via Watermarks for Federated LDMs
Jun 22, 2026Wenlong Cheng, Yuan Gan, Yunqiu Xu +1Diffusion Model Watermarking Latent Diffusion Models
Northwest Normal University · The University of Tokyo · National University of Singapore +1
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
Sep 8, 2026Wenrui Yu, Changlong Ji, Johannes Bjerva +1Federated Learning Aggregation Secure Aggregation
Aalborg University Copenhagen, Denmark · Institut Polytechnique de Paris Paris, France

Jul 7, 2026J/K move · Enter open · S save

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca, Graham Cormode+1

Indian Institute of Technology (BHU), Varanasi, India · University of Warwick, Coventry, UK · Vaulttree,, Ireland+2

Federated Learning Aggregation Byzantine-Robust Federated Learning Privacy-Preserving ML Secure Aggregation Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.

Abstract

Federated Learning

Explore similar work

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

FedOT: Ownership Verification and Leakage Tracing via Watermarks for Federated LDMs

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning