VeilFL: Two-Stage Accountability for Anonymous Federated Learning

Varesh Mishra; Aysajan Abidin; Bart Preneel

cs.CROct 31, 2026

VeilFL: Two-Stage Accountability for Anonymous Federated Learning

Authors: Varesh Mishra, Aysajan Abidin, Bart Preneel

Organizations: COSIC, KU Leuven, Belgium

Abstract

Anonymous credentials can hide which registered client participates in federated learning, but their unlinkability also makes repeated misconduct difficult to associate. We present VeilFL, a two-aggregator protocol that adds staged accountability to PINE (USENIX Security '24). Each submission binds two private PINE messages, a round-specific pseudonym, and a tracing pair to the same hidden credential secret. This design enables detection of duplicate submissions within a round without introducing a persistent identifier for normal participation. VeilFL implements accountability in two stages. After a confirmed duplicate or joint PINE rejection, a threshold tracing committee reveals a stable handle that links faults associated with the same credential. The client's registered identity is recoverable only after the public log records the requisite number of linked faults and a separate threshold committee authorizes identification. Accepted and unopened submissions remain unlinkable under the stated assumptions. This work establishes submission binding and duplicate detection, anonymity, fault non-frameability, controlled two-stage opening, and preservation of PINE's privacy and validity guarantees. In the prototype implementation, creating a submission requires a median of 2.11 ms, while verification requires 3.01 ms. Batch verification reduces the cost to 1.86 ms per submission for a batch of 1,000. The public part of each submission is 608 bytes, with 1,248 bytes of additional VeilFL protocol data across the two aggregator submissions. Each opening stage completes within 4.3 ms for the different committee configurations.

Figures & tables

Figure 1: System architecture of $\mathsf{VeilFL}$ . Clients obtain credentials and submit a common public part together with a private $\mathsf{PINE}$ message to each aggregator. Accepted updates are aggregated, while confirmed faults enter a two-stage accountability path. Tier 1 reveals a tracing handle for linking faults, and Tier 2 derives a directory handle for identity resolution after the fault threshold is reached.

Symbol	Meaning
$\mathsf{policyID}$	policy identifier under which faults are counted
$\mathsf{issuerKeyID}$	identifier of the current BBS issuer key
$\mathsf{pineID}$	identifier of the $\mathsf{PINE}$ parameters used in a round
$\mathsf{ctx}$	hash of the jointly signed round record
$M_{b}$	private message sent to $\mathsf{A}_{b}$ , containing its $\mathsf{PINE}$ data and a private hash nonce
$d_{b}$	hash of $M_{b}$ , bound to verifier role $b$

Table 1: Main notation.

Operation	Median (ms)	$P_{25}$ (ms)	$P_{75}$ (ms)
Client enrolment	$2.07$	$1.93$	$2.25$
Issuer enrolment	$0.77$	$0.60$	$0.87$
Client submission	$2.11$	$1.91$	$2.61$
Submission verification	$3.01$	$2.83$	$3.17$

Table 2: Latency of the main

\mathsf{VeilFL}

protocol operations. Values are median latency in milliseconds. P25 and P75 denote the 25th and 75th percentiles.

Figure 2: Amortized submission-verification cost as the batch size increases. The line shows the median and the shaded region shows the 25th-75th percentile range.

Figure 3: Latency of Tier 1 linking and Tier 2 identification for different threshold committee configurations. Points show median latency and error bars show the 25th-75th percentile range.

Property	$\mathsf{PINE}$ [ 23 ]	$\mathsf{ACORN}$ [ 2 ]	$\mathsf{WhiteCloak}$ [ 19 ]	$\mathsf{PAPR}$ [ 7 ]	$\mathsf{VeilFL}$
System model	2 verifiers	1 server	1 server with $\mathsf{ACORN}$	Credential system	2 aggregators
Update validation	Exact encoded-integer $\ell_{2}$ bound	$\ell_{0},\ell_{2},\ell_{\infty}$ predicates	$\mathsf{ACORN}$ predicates	Not applicable	Exact encoded-integer $\ell_{2}$ bound via $\mathsf{PINE}$
Anonymous participation	No	No	Yes	Yes	Yes
Cross-round fault accountability	None	None	Anonymous blacklisting	Not applicable	Links confirmed faults across rounds
Identity opening	Not provided	Not provided	Not provided	After a logged request	After $q$ linked faults via a separate committee
Client-to-client coordination	None	Pairwise keys/masks	Pairwise keys/masks	Not applicable	None

Table 3: Selected functional comparison with related systems.

Privacy-Preserving Federated Learning

See all 51 papers

AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning
Oct 30, 2026Alexandros Balla, Spyros LalisFederated Learning Blockchain-Based Federated Learning
Department of Computer Science and Engineering Hong Kong University of Science and Technology Hong Kong SAR, China · Department of Electrical and Computer Engineering University of Thessaly Volos, Greece
End-to-End Verifiable and Robust Federated Learning
Sep 14, 2026Doryan Lesaignoux, Enrique Mármol Campos, Gabriele Spini +2Federated Learning Aggregation Byzantine-Robust Federated Learning
AIT Austrian Institute of Technology · Vienna, Austria · Department of Computer Engineering +2
PoCoFL: POlicy-COmpliant Federated Learning
Oct 2, 2026Dominik Roy George, Varesh Mishra, Aysajan AbidinFederated Learning Privacy-Preserving Federated Learning
COSIC, KU Leuven, Belgium

Oct 30, 2026J/K move · Enter open · S save

AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

Alexandros Balla, Spyros Lalis

Department of Computer Science and Engineering Hong Kong University of Science and Technology Hong Kong SAR, China · Department of Electrical and Computer Engineering University of Thessaly Volos, Greece

Federated Learning Blockchain-Based Federated Learning Incentive Mechanisms for Federated Learning

Open paper AskPDF arXiv

Federated learning (FL) keeps raw data local, but most deployments still rely on a trusted coordinator for client admission, checkpoint distribution, update collection, aggregation, and rewards. This paper presents AuditFL, a contract-backed clearing layer for auditable FL in open settings. AuditFL keeps training and aggregation off chain, stores model artifacts in an assumed reliable off-chain artifact store, and records only content identifiers and economic state on chain. Clients reserve update tickets with deposits, publish update identifiers, and later claim refunds or rewards; the task coordinator publishes global checkpoints and finalizes rounds through deterministic settlement rules. The design does not remove the aggregator, but makes its on-chain round decisions attributable, replayable, auditable, and economically constrained. We implement AuditFL as both a deterministic state-machine prototype and a Solidity contract on a local Ethereum-compatible Anvil chain. On full MNIST with Dirichlet non-IID splits, 12 rounds, and up to 200 clients, AuditFL preserves the Plain FL learning trajectory while its overhead follows closed-form control-plane models. At 200 clients, the contract run issues 5,026 transactions, stores 2,413 off-chain artifacts (144.9 MiB), and consumes 829.7M EVM gas, dominated by per-client reserve and publish calls. Controlled dropout, invalid-update, and artifact-unavailability stress tests reduce inclusion nearly linearly but still finalize rounds, with final-accuracy changes remaining within a few tenths of an accuracy percentage point even under high injected failure rates.

Abstract

Privacy-Preserving Federated Learning

Explore similar work

AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

End-to-End Verifiable and Robust Federated Learning

PoCoFL: POlicy-COmpliant Federated Learning