OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

Hongxu Su; Jianzhu Yao; Xuechao Wang; Pramod Viswanath

cs.CRSep 29, 2026

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

Authors: Hongxu Su, Jianzhu Yao, Xuechao Wang, Pramod Viswanath

Abstract

Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving $0$ % ASR against model poisoning and PGD-based attacks. On a LeNet workload, at $p=0.01$ , OPFL is approximately $98.6\times$ faster than full MPC-based FL and $625.5\times$ faster than ZK-based approach.

Figures & tables

Figure 1: Overview of the OPFL protocol.

Model	#Parameters	Training	Optimizer	Datasets
LeNet	431K	Full training	Momentum SGD	MNIST, Fashion-MNIST
BERT-Base	110M	LoRA, last two layers	AdamW	SST-2, CoLA
Qwen3	0.6B	LoRA, last two layers	SGD	Alpaca, Dolly

Table 1: Models and training configurations used in our evaluation.

Table 2: Summary of attack evaluation. (a) General-attack results across all evaluated models and settings. (b) Maximum ASR (%) over PGD attack strengths

\beta\in\{0.01,0.1,0.5,1,2,5,10\}

Method	Time (s)	Time ratio	Deposit	Deposit ratio
ZKSL-G	16.09K	8.38	0.00	0.00
ZKSL-LP-G	12.19K	6.35	0.00	0.00
Full MPC-based FL	1.92K	1.00	0.00	0.00
OPFL , $p=0.10$	192.35	0.10	1.11	1.00
OPFL , $p=0.05$	96.32	0.05	1.12	1.01
OPFL , $p=0.01$	19.49	0.01	1.76	1.59

Table 4: Verification cost and normalized deposit. K denotes

10^{3}

. Deposit ratios are normalized to OPFL with

p=0.10

and use

p_{\mathrm{FR}}=0.01

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 3 — Figure 3: Generalization of the deployed boundaries calibrated from 100 steps for Qwen3, BERT, and LeNet. The top and bottom rows show absolute and relative gradient discrepancies, respectively. Solid lines and shaded regions show the median and percentile range across evaluation steps, respectively; dashed lines indicate the deployed boundaries.

Verifier	Acceptance rule
No verifier	Always accept
RoFL- $L_{2}$	$\\|\widetilde{G}_{i,t}\\|_{2}\leq B_{2}$
RoFL- $L_{\infty}$	$\\|\widetilde{G}_{i,t}\\|_{\infty}\leq B_{\infty}^{\mathrm{RoFL}}$
EIFFeL-NormBall	$\\|\widetilde{G}_{i,t}-V_{t}\\|_{2}\leq R$
RiseFL-Gaussian	Gaussian projection norm test
OPFL	$P_{i,t}^{\mathrm{abs}}(p)\leq B_{p}^{\mathrm{abs}}$ and $P_{i,t}^{\mathrm{rel}}(p)\leq B_{p}^{\mathrm{rel}}$ , $\forall p\in\mathcal{P}$ and $\Delta_{i,t}^{\infty}\leq B_{\infty}$

Appendix

Table 5: Verification rules used in the adaptive PGD evaluation.

$\beta$	None	RoFL- $L_{2}$	RoFL- $L_{\infty}$	EIFFeL	RiseFL
0.01	0.0	0.0	0.0	0.0	0.0
0.1	4.5	4.5	4.5	4.5	4.5
0.5	29.5	29.5	29.5	29.5	29.5
1	57.0	57.0	57.0	57.0	57.0
2	90.0	90.0	90.0	89.5	90.0
5	99.0	90.5	99.0	68.0	97.99

Appendix

Table 6: Adaptive PGD attack success rate (%) on LeNet.

$\beta$	None	RoFL- $L_{2}$	RoFL- $L_{\infty}$	EIFFeL	RiseFL
0.01	0.0	0.0	0.0	0.0	0.0
0.1	4.5	4.5	4.5	4.5	4.5
0.5	20.0	20.0	20.0	20.0	20.0
1	35.5	33.5	35.0	32.0	34.5
2	49.5	33.5	37.5	27.0	21.0
5	72.0	0.0	14.0	0.0	0.0

Appendix

Table 7: Adaptive PGD attack success rate (%) on BERT-Base.

$\beta$	None	RoFL- $L_{2}$	RoFL- $L_{\infty}$	EIFFeL	RiseFL
0.01	0.0	0.0	0.0	0.0	0.0
0.1	0.0	0.0	0.0	0.0	0.0
0.5	0.0	0.0	0.0	0.0	0.0
1	0.0	0.0	0.0	0.0	0.0
2	7.0	7.0	7.0	7.0	7.0
5	20.0	5.5	20.0	5.5	12.42

Appendix

Table 8: Adaptive PGD attack success rate (%) on Qwen3-0.6B.

	1% support		10% support
$\beta$	No verifier	OPFL	No verifier	OPFL
0.01	0.0	0.0	0.0	0.0
0.1	0.0	0.0	0.0	0.0
0.5	0.0	0.0	0.0	0.0
1	1.5	0.0	4.5	0.0
2	6.5	0.0	12.0	0.0

Appendix

Table 9: Tail-sparse PGD attack success rate (%) on LeNet.

Explore similar work

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning
Jul 7, 2026Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca +2Federated Learning Homomorphic Encryption
Indian Institute of Technology (BHU), Varanasi, India · University of Warwick, Coventry, UK · Vaulttree,, Ireland +2
End-to-End Verifiable and Robust Federated Learning
Sep 14, 2026Doryan Lesaignoux, Enrique Mármol Campos, Gabriele Spini +2Federated Learning Zero-Knowledge Proofs
AIT Austrian Institute of Technology · Vienna, Austria · Department of Computer Engineering +2
FedReview: Review and Dispose Poisoned Updates without Validation Datasets or Historic Knowledge
Feb 26, 2024Tianhang Zheng, Yanlu Li, Bohan Deng +1Federated Learning Poisoning
University of Missouri-Kansas City · University of Toronto

Jul 7, 2026, cs.CRJ/K move · Enter open · S save

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca, Graham Cormode+1

Indian Institute of Technology (BHU), Varanasi, India · University of Warwick, Coventry, UK · Vaulttree,, Ireland+2

Federated Learning Homomorphic Encryption

Open paper AskPDF arXiv

Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.

Abstract

Explore similar work

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

End-to-End Verifiable and Robust Federated Learning

FedReview: Review and Dispose Poisoned Updates without Validation Datasets or Historic Knowledge