PoCoFL: POlicy-COmpliant Federated Learning

Dominik Roy George; Varesh Mishra; Aysajan Abidin

cs.CROct 2, 2026

PoCoFL: POlicy-COmpliant Federated Learning

Authors: Dominik Roy George, Varesh Mishra, Aysajan Abidin

Organizations: COSIC, KU Leuven, Belgium

Abstract

Federated Learning (FL) is a privacy-oriented learning paradigm that enables collaborative model training while keeping training data local to participating clients. However, it does not guarantee that clients submit policy-compliant contributions or that aggregators process admitted contributions correctly. Existing verifiable FL systems tailor validation rules to specific FL settings, learning workflows, and cryptographic constructions, limiting their applicability across network topologies, participant roles, and aggregation semantics. In this paper, we present PoCoFL, a policy-compliant federated learning framework that separates three aspects: (i) FL type, (ii) policy semantics, and (iii) cryptographic realisation. We provide a formalisation that captures client and aggregation requirements as policy-dependent relations. Clients prove compliance of their contributions using commitments and non-interactive zero-knowledge proofs, while aggregators prove that the recorded set of admitted contributions was processed according to the selected aggregation policy. We demonstrate PoCoFL through four formal instantiations: (i) vanilla, (ii) continual, (iii) personalised, and (iv) threshold-encrypted federated learning. We evaluate the effects of policy enforcement on the learning objectives of vanilla, personalised, and continual FL. We further implement proof-of-concept realisations of all four instantiations, demonstrating the versatility and practical feasibility of PoCoFL. Overall, these results show that PoCoFL can capture complex policy representations while remaining network-topology agnostic.

Figures & tables

Fig. 1: PoCoFL system model linking FL settings, policy predicates, and verifiability guarantees.

Fig. 2: Effect of policy enforcement under model-poisoning attacks in vanilla (a), personalised (b-d), and continual (e-h) FL. Shading denotes standard deviation across five paired seeds. In (h), upper/lower triangles show policy enforcement on/off, respectively.

Fig. 3: EZKL timing over five rounds at $K=5$ : (a) mean client-proof generation, (b) aggregation-proof generation, (c) five-client cohort admission, and (d) mean proof-verification time. Shading in (a) and error bars in (d) show $\pm$ one sample standard deviation.

Type	Participant	Policy	$k$	Rows	$N$	Gen./op. (s)	Server-side validation (s)	Evidence (KiB)	Payload (KiB)
Vanilla FL	Client	$\mathsf{Pred}_{\phi_{\mathsf{loss}}}$	20	455,104	25	80.349 $\pm$ 0.333	–	41.59	$\uparrow$ 104.80/client
Vanilla FL	Aggregator	$\mathsf{Pred}_{\psi_{\mathsf{FedAvg}}}$	21	1,619,920	5	121.175 $\pm$ 0.506	8.900 $\pm$ 0.043	1103.54	$\downarrow$ 523.99/cohort $\uparrow$ 309.94/cohort
Continual FL	Client	$\mathsf{Pred}_{\phi_{\mathsf{EWC}}}$	22	3,320,727	25	541.652 $\pm$ 73.508	–	2188.70	$\uparrow$ 2,283.06/client
Continual FL	Aggregator	$\mathsf{Pred}_{\psi_{\mathsf{FedAvg}}}$	22	3,229,170	5	568.800 $\pm$ 2.764	28.332 $\pm$ 0.218	2176.80	$\downarrow$ 11,415.32/cohort $\uparrow$ 310.47/cohort
Personalized FL	Client	$\mathsf{Pred}_{\phi_{\mathsf{pFedMe}}}$	22	3,102,752	25	640.166 $\pm$ 17.073	–	2189.16	$\uparrow$ 2,283.59/client
Personalized FL	Aggregator	$\mathsf{Pred}_{\psi_{\mathsf{pFedMe}}}$	22	3,230,605	5	523.948 $\pm$ 0.765	28.412 $\pm$ 0.152	2174.72	$\downarrow$ 11,417.94/cohort $\uparrow$ 311.51/cohort

TABLE I: AWS microbenchmarks with

28\!\times\!28

inputs, five clients and five measured rounds, with both policies enabled. Times are mean

\pm

sample standard deviation; sizes are means.

\uparrow

\downarrow

denote sent/received payloads.

	Techniques	Policy-compliance guarantees		Privacy guarantee	Framework modularity
	Techniques	(R2) Verifiable client-policy compliance	(R3) Verifiable aggregation-policy compliance	(R4) Private policy verification	(R1) Type-aware policy configuration	(R5) Cryptographic modularity and agility
VerifyNet [ 31 ]	SecAgg , SS , homomorphic hashing	$\Circle$	$\Circle$ ∗	$\CIRCLE$	$\Circle$	$\Circle$
EIFFeL [ 6 ]	SS , VSS , ZKP s	$\CIRCLE$	$\Circle$	$\CIRCLE$	$\Circle$	$\Circle$
RoFL [ 23 ]	SecAgg , commitments, ZKP s	$\CIRCLE$	$\Circle$	$\CIRCLE$	$\Circle$	$\Circle$
ACORN [ 24 ]	SecAgg , commitments, ZKP s	$\CIRCLE$	$\Circle$	$\CIRCLE$	$\Circle$	$\Circle$
RiseFL [ 33 ]	SecAgg , commitments, VSS , ZKP s	$\CIRCLE$	$\Circle$	$\CIRCLE$	$\Circle$	$\Circle$

TABLE II: Comparison of verifiable federated-learning systems with respect to the policy-compliance Requirements (R1) – (R5) defined in Sec. II-B . A filled circle indicates explicit support under the definitions below.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Game

\mathsf{Game}^{\mathsf{adm}}_{\mathfrak{F},\mathcal{A}_{1}}(1^{\lambda})

\triangleright

Setup

Challenger

\mathcal{C}

computes

(\mathsf{pp}_{\mathfrak{F}},\{\mathsf{st}^{\mathsf{setup}}_{P}\}_{P\in\mathcal{P}})\leftarrow\mathfrak{F}.\mathsf{Setup}(1^{\lambda}).

\mathcal{C}

gives

(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi})

and the prescribed setup state of the corrupted client to

\mathcal{A}_{1}

\triangleright

Adversary output

The adversary, acting as corrupted client

i

, outputs

\mu_{i,t}\leftarrow\mathcal{A}_{1}(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi}).

Return

1

if and only if

\mathfrak{F}.\mathsf{VfyClient}(\kappa_{t}^{\phi},i,\mu_{i,t})=1\,\land\,\mathfrak{F}.\mathsf{ValidClient}(\kappa_{t}^{\phi},i,\mu_{i,t})=0.

Appendix

Fig. 7: Update-admissibility game.

Game

\mathsf{Game}^{\mathsf{agg}}_{\mathfrak{F},\mathcal{A}_{2}}(1^{\lambda})

\triangleright

Setup

Challenger

\mathcal{C}

computes

(\mathsf{pp}_{\mathfrak{F}},\{\mathsf{st}^{\mathsf{setup}}_{P}\}_{P\in\mathcal{P}})\leftarrow\mathfrak{F}.\mathsf{Setup}(1^{\lambda}).

\mathcal{C}

gives

(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi},\psi)

and the prescribed setup state of the corrupted aggregator to

\mathcal{A}_{2}

\triangleright

Adversary output

The adversarial aggregator outputs

(\mathsf{Rec}_{t},\nu_{t})\leftarrow\mathcal{A}_{2}(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi},\psi).

Return

1

if and only if

\displaystyle\mathfrak{F}.\mathsf{VfyAgg}(\kappa_{t}^{\phi},\psi,\mathsf{Rec}_{t},\nu_{t})=1

\displaystyle}{\displaystyle\land\mathfrak{F}.\mathsf{ValidAgg}(\kappa_{t}^{\phi},\psi,\mathsf{Rec}_{t},\nu_{t})=0.

Appendix

Fig. 8: Aggregation-correctness game.

Game

\mathsf{Game}^{\mathsf{priv}}_{\mathfrak{F},\mathcal{A}_{2}}(1^{\lambda},b)

\triangleright

Setup

Challenger

\mathcal{C}

computes

(\mathsf{pp}_{\mathfrak{F}},\{\mathsf{st}^{\mathsf{setup}}_{P}\}_{P\in\mathcal{P}})\leftarrow\mathfrak{F}.\mathsf{Setup}(1^{\lambda}).

\mathcal{C}

gives

(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi})

and the prescribed setup state of the corrupted participant to

\mathcal{A}_{2,1}

\triangleright

Challenge selection

The first-stage adversary outputs

(i,s_{0},s_{1},\mathsf{st})\leftarrow\mathcal{A}_{2,1}(\mathsf{pp}_{\mathfrak{F}},\kappa_{t}^{\phi}).

\triangleright

Challenge construction

For each

j\in\{0,1\}

\mathcal{C}

computes

(x_{j},w_{j})\leftarrow\mathfrak{F}.\mathsf{BuildClient}(\kappa_{t}^{\phi},i,s_{j}).

\triangleright

Admissibility

\mathfrak{F}.\mathsf{CommonCtx}(x_{0})\neq\mathfrak{F}.\mathsf{CommonCtx}(x_{1})

(x_{j},w_{j})\notin\mathcal{R}_{\phi}\hskip 9.24994pt\text{for some }j\in\{0,1\},

Return

0

\triangleright

Challenge

Appendix

Fig. 9: Policy-relative-privacy game.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary
Sep 29, 2026Hongxu Su, Jianzhu Yao, Xuechao Wang +1Federated Learning Privacy-Preserving Federated Learning
PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning
Jul 7, 2026Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca +2Federated Learning Aggregation Byzantine-Robust Federated Learning
Indian Institute of Technology (BHU), Varanasi, India · University of Warwick, Coventry, UK · Vaulttree,, Ireland +2
PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors
Mar 4, 2026Kelly L Vomo-Donfack, Adryel Hoszu, Grégory Ginot +1Privacy-Preserving Federated Learning Federated Learning
Université Sorbonne Paris Nord, LAGA, CNRS, UMR 7539, Laboratoire d’excellence Infibrex, F-93430 Villetaneuse, France · Instituto de Hortofruticultura Subtropical y Mediterránea La Mayora (IHSM), Universidad de Málaga–Consejo Superior de Investigaciones Científicas, Málaga, Spain

Sep 29, 2026J/K move · Enter open · S save

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

Hongxu Su, Jianzhu Yao, Xuechao Wang, Pramod Viswanath

Federated Learning Privacy-Preserving Federated Learning

Open paper AskPDF arXiv

Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving

0

% ASR against model poisoning and PGD-based attacks. On a LeNet workload, at

p=0.01

, OPFL is approximately

98.6\times

faster than full MPC-based FL and

625.5\times

faster than ZK-based approach.

Abstract

Federated Learning

Explore similar work

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors