ML Security PapersZK-HybridFL: Zero-Knowledge Proof-Enhanced Hybrid Ledger for Federated Learning
Amirhossein Taherpour , Xiaodong Wang
Published on arXiv
2601.22302
Data Poisoning Attack
OWASP ML Top 10 — ML02
Model Inversion Attack
OWASP ML Top 10 — ML03
Key Finding
ZK-HybridFL achieves faster convergence, higher accuracy, lower perplexity, and reduced latency than Blade-FL and ChainFL while remaining robust against substantial fractions of adversarial nodes and supporting sub-second on-chain verification.
ZK-HybridFL
Novel technique introduced
Federated learning (FL) enables collaborative model training while preserving data privacy, yet both centralized and decentralized approaches face challenges in scalability, security, and update validation. We propose ZK-HybridFL, a secure decentralized FL framework that integrates a directed acyclic graph (DAG) ledger with dedicated sidechains and zero-knowledge proofs (ZKPs) for privacy-preserving model validation. The framework uses event-driven smart contracts and an oracle-assisted sidechain to verify local model updates without exposing sensitive data. A built-in challenge mechanism efficiently detects adversarial behavior. In experiments on image classification and language modeling tasks, ZK-HybridFL achieves faster convergence, higher accuracy, lower perplexity, and reduced latency compared to Blade-FL and ChainFL. It remains robust against substantial fractions of adversarial and idle nodes, supports sub-second on-chain verification with efficient gas usage, and prevents invalid updates and orphanage-style attacks. This makes ZK-HybridFL a scalable and secure solution for decentralized FL across diverse environments.
Key Contributions
- ZK-HybridFL framework combining a DAG ledger with dedicated sidechains and ZKPs to validate FL model updates without exposing participant data or requiring a public validation dataset
- Event-driven smart contracts and oracle-assisted sidechain enabling sub-second on-chain verification with efficient gas usage
- Built-in challenge mechanism for detecting adversarial and idle nodes, preventing invalid updates and orphanage-style attacks in decentralized FL
🛡️ Threat Analysis
The paper proposes a Byzantine-fault-tolerant FL protocol (a class of defense explicitly listed under ML02) with a built-in challenge mechanism to detect adversarial nodes sending invalid or malicious model updates, and the framework is evaluated on its robustness against substantial fractions of adversarial participants corrupting the global model.
The ZKP component is explicitly motivated by gradient inversion and label inference attacks cited in the introduction — ZKPs allow validation of model updates without exposing gradients or training data to the verifier, directly defending against reconstruction-style adversaries in the FL aggregation path.