ML Security PapersArmadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation
Yiping Ma 1,2,3, Yue Guo 3, Harish Karthikeyan 3, Antigoni Polychroniadou 3
Published on arXiv
2511.10863
Data Poisoning Attack
OWASP ML Top 10 — ML02
Model Inversion Attack
OWASP ML Top 10 — ML03
Key Finding
Achieves disruption-resistant secure aggregation in 3 rounds with low per-client cost, outperforming prior single-server FL protocols on both round complexity and computational overhead.
Armadillo
Novel technique introduced
This paper presents a secure aggregation system Armadillo that has disruptive resistance against adversarial clients, such that any coalition of malicious clients (within the tolerated threshold) can affect the aggregation result only by misreporting their private inputs in a pre-defined legitimate range. Armadillo is designed for federated learning setting, where a single powerful server interacts with many weak clients iteratively to train models on client's private data. While a few prior works consider disruption resistance under such setting, they either incur high per-client cost (Chowdhury et al. CCS '22) or require many rounds (Bell et al. USENIX Security '23). Although disruption resistance can be achieved generically with zero-knowledge proof techniques (which we also use in this paper), we realize an efficient system with two new designs: 1) a simple two-layer secure aggregation protocol that requires only simple arithmetic computation; 2) an agreement protocol that removes the effect of malicious clients from the aggregation with low round complexity. With these techniques, Armadillo completes each secure aggregation in 3 rounds while keeping the server and clients computationally lightweight.
Key Contributions
- Armadillo: a single-server secure aggregation system with provable disruption resistance, limiting malicious clients to only misreporting within a legitimate input range via zero-knowledge proofs
- A two-layer secure aggregation protocol requiring only simple arithmetic, dramatically reducing per-client computational cost compared to prior work (Chowdhury et al. CCS '22)
- An agreement protocol that removes malicious client contributions from aggregation in low round complexity (3 rounds total), improving on Bell et al. USENIX Security '23
🛡️ Threat Analysis
Primary contribution is a Byzantine-fault-tolerant FL aggregation protocol with disruption resistance — malicious clients are constrained to legitimate input ranges via input validation (ZKP-based), directly defending against adversarial clients poisoning the aggregated model update.
The secure aggregation design explicitly prevents the server from learning individual client gradient updates, defending against gradient leakage/reconstruction attacks — per guidelines, FL secure aggregation protocols that defend against gradient leakage qualify as ML03.