VeilFL: Two-Stage Accountability for Anonymous Federated Learning

Varesh Mishra; Aysajan Abidin; Bart Preneel

cs.CROct 31, 2026

VeilFL: Two-Stage Accountability for Anonymous Federated Learning

Authors: Varesh Mishra, Aysajan Abidin, Bart Preneel

Organizations: COSIC, KU Leuven, Belgium

Abstract

Anonymous credentials can hide which registered client participates in federated learning, but their unlinkability also makes repeated misconduct difficult to associate. We present VeilFL, a two-aggregator protocol that adds staged accountability to PINE (USENIX Security '24). Each submission binds two private PINE messages, a round-specific pseudonym, and a tracing pair to the same hidden credential secret. This design enables detection of duplicate submissions within a round without introducing a persistent identifier for normal participation. VeilFL implements accountability in two stages. After a confirmed duplicate or joint PINE rejection, a threshold tracing committee reveals a stable handle that links faults associated with the same credential. The client's registered identity is recoverable only after the public log records the requisite number of linked faults and a separate threshold committee authorizes identification. Accepted and unopened submissions remain unlinkable under the stated assumptions. This work establishes submission binding and duplicate detection, anonymity, fault non-frameability, controlled two-stage opening, and preservation of PINE's privacy and validity guarantees. In the prototype implementation, creating a submission requires a median of 2.11 ms, while verification requires 3.01 ms. Batch verification reduces the cost to 1.86 ms per submission for a batch of 1,000. The public part of each submission is 608 bytes, with 1,248 bytes of additional VeilFL protocol data across the two aggregator submissions. Each opening stage completes within 4.3 ms for the different committee configurations.

Figures & tables

Figure 1: System architecture of $\mathsf{VeilFL}$ . Clients obtain credentials and submit a common public part together with a private $\mathsf{PINE}$ message to each aggregator. Accepted updates are aggregated, while confirmed faults enter a two-stage accountability path. Tier 1 reveals a tracing handle for linking faults, and Tier 2 derives a directory handle for identity resolution after the fault threshold is reached.

Symbol	Meaning
$\mathsf{policyID}$	policy identifier under which faults are counted
$\mathsf{issuerKeyID}$	identifier of the current BBS issuer key
$\mathsf{pineID}$	identifier of the $\mathsf{PINE}$ parameters used in a round
$\mathsf{ctx}$	hash of the jointly signed round record
$M_{b}$	private message sent to $\mathsf{A}_{b}$ , containing its $\mathsf{PINE}$ data and a private hash nonce
$d_{b}$	hash of $M_{b}$ , bound to verifier role $b$

Table 1: Main notation.

Operation	Median (ms)	$P_{25}$ (ms)	$P_{75}$ (ms)
Client enrolment	$2.07$	$1.93$	$2.25$
Issuer enrolment	$0.77$	$0.60$	$0.87$
Client submission	$2.11$	$1.91$	$2.61$
Submission verification	$3.01$	$2.83$	$3.17$

Table 2: Latency of the main

\mathsf{VeilFL}

protocol operations. Values are median latency in milliseconds. P25 and P75 denote the 25th and 75th percentiles.

Figure 2: Amortized submission-verification cost as the batch size increases. The line shows the median and the shaded region shows the 25th-75th percentile range.

Figure 3: Latency of Tier 1 linking and Tier 2 identification for different threshold committee configurations. Points show median latency and error bars show the 25th-75th percentile range.

Property	$\mathsf{PINE}$ [ 23 ]	$\mathsf{ACORN}$ [ 2 ]	$\mathsf{WhiteCloak}$ [ 19 ]	$\mathsf{PAPR}$ [ 7 ]	$\mathsf{VeilFL}$
System model	2 verifiers	1 server	1 server with $\mathsf{ACORN}$	Credential system	2 aggregators
Update validation	Exact encoded-integer $\ell_{2}$ bound	$\ell_{0},\ell_{2},\ell_{\infty}$ predicates	$\mathsf{ACORN}$ predicates	Not applicable	Exact encoded-integer $\ell_{2}$ bound via $\mathsf{PINE}$
Anonymous participation	No	No	Yes	Yes	Yes
Cross-round fault accountability	None	None	Anonymous blacklisting	Not applicable	Links confirmed faults across rounds
Identity opening	Not provided	Not provided	Not provided	After a logged request	After $q$ linked faults via a separate committee
Client-to-client coordination	None	Pairwise keys/masks	Pairwise keys/masks	Not applicable	None

Table 3: Selected functional comparison with related systems.

Privacy-Preserving Federated Learning

See all 51 papers

Oct 30, 2026

AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

Federated learning (FL) keeps raw data local, but most deployments still rely on a trusted coordinator for client admission, checkpoint distribution, update collection, aggregation, and rewards. This paper presents AuditFL, a contract-backed clearing layer for auditable FL in open settings. AuditFL keeps training and aggregation off chain, stores model artifacts in an assumed reliable off-chain artifact store, and records only content identifiers and economic state on chain. Clients reserve update tickets with deposits, publish update identifiers, and later claim refunds or rewards; the task coordinator publishes global checkpoints and finalizes rounds through deterministic settlement rules. The design does not remove the aggregator, but makes its on-chain round decisions attributable, replayable, auditable, and economically constrained. We implement AuditFL as both a deterministic state-machine prototype and a Solidity contract on a local Ethereum-compatible Anvil chain. On full MNIST with Dirichlet non-IID splits, 12 rounds, and up to 200 clients, AuditFL preserves the Plain FL learning trajectory while its overhead follows closed-form control-plane models. At 200 clients, the contract run issues 5,026 transactions, stores 2,413 off-chain artifacts (144.9 MiB), and consumes 829.7M EVM gas, dominated by per-client reserve and publish calls. Controlled dropout, invalid-update, and artifact-unavailability stress tests reduce inclusion nearly linearly but still finalize rounds, with final-accuracy changes remaining within a few tenths of an accuracy percentage point even under high injected failure rates.

Alexandros Balla, Spyros Lalis

Department of Computer Science and Engineering Hong Kong University of Science and Technology Hong Kong SAR, China · Department of Electrical and Computer Engineering University of Thessaly Volos, Greece

Federated Learning Blockchain-Based Federated Learning Incentive Mechanisms for Federated Learning

Ask PDF

Sep 14, 2026

End-to-End Verifiable and Robust Federated Learning

Federated learning enables multiple parties to train a shared model without centralizing raw data with the help of an aggregator, but introduces integrity risks once participants or infrastructure are not fully trustworthy. Two requirements are particularly important: robustness to poisoned or Byzantine client updates, and verifiability of the aggregator so that clients or third parties can audit the reported aggregation without learning individual updates. Existing work has largely treated these goals separately, and efficient public verifiability for robust, outlier-excluding aggregation remains limited. We present a verifiable federated learning protocol that makes a robust aggregation pipeline publicly auditable. Our design combines cryptographic commitments with non-interactive zero-knowledge proofs to certify both (i) cosine-similarity-based outlier exclusion and (ii) aggregation over the selected set, without revealing individual client updates to verifiers. In experiments under representative poisoning attacks, our method maintains high accuracy, with an average accuracy loss below 4% across the evaluated configurations, while keeping verification overhead practical: proof artifacts can be generated and verified within minutes at the scale studied. In summary, our results show that robust outlier exclusion and public verifiability can be jointly achieved in a federated learning setting.

Doryan Lesaignoux, Enrique Mármol Campos, Gabriele Spini +2

AIT Austrian Institute of Technology · Vienna, Austria · Department of Computer Engineering +2

Federated Learning Aggregation Byzantine-Robust Federated Learning Federated Learning

Ask PDF

Oct 2, 2026

PoCoFL: POlicy-COmpliant Federated Learning

Federated Learning (FL) is a privacy-oriented learning paradigm that enables collaborative model training while keeping training data local to participating clients. However, it does not guarantee that clients submit policy-compliant contributions or that aggregators process admitted contributions correctly. Existing verifiable FL systems tailor validation rules to specific FL settings, learning workflows, and cryptographic constructions, limiting their applicability across network topologies, participant roles, and aggregation semantics. In this paper, we present PoCoFL, a policy-compliant federated learning framework that separates three aspects: (i) FL type, (ii) policy semantics, and (iii) cryptographic realisation. We provide a formalisation that captures client and aggregation requirements as policy-dependent relations. Clients prove compliance of their contributions using commitments and non-interactive zero-knowledge proofs, while aggregators prove that the recorded set of admitted contributions was processed according to the selected aggregation policy. We demonstrate PoCoFL through four formal instantiations: (i) vanilla, (ii) continual, (iii) personalised, and (iv) threshold-encrypted federated learning. We evaluate the effects of policy enforcement on the learning objectives of vanilla, personalised, and continual FL. We further implement proof-of-concept realisations of all four instantiations, demonstrating the versatility and practical feasibility of PoCoFL. Overall, these results show that PoCoFL can capture complex policy representations while remaining network-topology agnostic.

Dominik Roy George, Varesh Mishra, Aysajan Abidin

COSIC, KU Leuven, Belgium

Federated Learning Privacy-Preserving Federated Learning Federated Learning Aggregation

Ask PDF

Abstract

Privacy-Preserving Federated Learning

Explore similar work

AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

End-to-End Verifiable and Robust Federated Learning

PoCoFL: POlicy-COmpliant Federated Learning