Quantum Key Distribution Secured Federated Learning for Channel Estimation and Radar Spectrum Sensing in 6G Networks

1. Problem Statement

The integration of Artificial Intelligence (AI) and Machine Learning (ML) into Next-Generation (6G/NextG) networks is critical for tasks like wireless channel estimation and radar spectrum sensing. However, deploying Federated Learning (FL) in these environments introduces significant security and privacy risks:

• Privacy Leakage: Even without raw data, model updates (gradients or weights) transmitted from clients to a central server can be reverse-engineered by eavesdroppers or a "honest-but-curious" server to infer sensitive local data.
• Adversarial Attacks: Malicious actors can poison models or perform inference attacks.
• Key Vulnerability: Traditional cryptographic secure aggregation relies on pre-shared keys. If these keys are compromised, the entire aggregation process becomes insecure.
• Need for Information-Theoretic Security: 6G networks require ultra-low latency and high security. The authors propose moving beyond computational security to information-theoretic security using Quantum Key Distribution (QKD) to protect FL model updates.

2. Methodology

The paper proposes a framework that integrates BB84-style Quantum Key Distribution (QKD) with pairwise additive masking to secure the FL aggregation process.

A. System Architecture

• Tasks: The framework is applied to two distinct 6G tasks:
  1. Channel Estimation: Using a Convolutional Neural Network (CNN) to predict channel magnitude from OFDM pilot spectrograms.
  2. Radar Spectrum Sensing: Using a U-Net architecture for pixel-wise semantic segmentation of spectrograms to distinguish between Noise, LTE, 5G NR, and Radar signals.
• QKD Protocol (BB84 Abstraction):
  • A BB84-style protocol is modeled as a black box between clients and the server (or among clients) to generate a shared secret seed key ($k^{(r)}$) for each FL round.
  • Sifting & QBER Check: The protocol calculates the Quantum Bit Error Rate (QBER). If QBER exceeds a threshold ($\tau_{QBER}$), it indicates eavesdropping (Eve), and the round is aborted immediately.
  • Privacy Amplification: A hash-based extractor reduces the sifted key to a final secret seed.
• Pairwise Additive Masking:
  • Instead of independent QKD sessions for every pair, a single round seed $k^{(r)}$ is used to deterministically derive pairwise masking keys ($k_{ij}$) via a Key Derivation Function (KDF).
  • Masking Mechanism: Client $i$ generates a mask $m_{ij}$ for every other client $j$.
    • If $i < j$, Client $i$ adds $m_{ij}$ to its update.
    • If $i > j$, Client $i$ subtracts $m_{ij}$ from its update.
  • Aggregation: When the server aggregates all masked updates ($\sum \tilde{\theta}^{(i)}$), the masks cancel out perfectly ($\sum (m_{ij} - m_{ji}) = 0$), revealing only the true global average without exposing individual client parameters.

B. Threat Model

• Semi-honest Server: Follows the protocol but attempts to infer client data.
• Passive Eavesdropper (Eve): Observes all transmitted masked parameters but lacks the QKD keys.
• Active Eavesdropper: Performs intercept-resend attacks, which increases the QBER, triggering the abort mechanism.

3. Key Contributions

1. Formalized System Model: Coupled BB84-style QKD with pairwise additive masking for secure FL, deriving mathematical conditions for reconstruction correctness and QBER-based abort logic.
2. Dual-Task Application: Successfully applied the framework to two complex 6G scenarios:
   • Channel Estimation: CNN on Rayleigh-fading pilot data.
   • Radar Sensing: U-Net on spectrogram segmentation (Noise/LTE/NR/Radar classification).
3. Security Verification: Demonstrated that the presence of an eavesdropper raises the QBER to ~25%, causing all rounds to abort as intended, thereby preventing the use of compromised keys.
4. Performance Characterization: Evaluated the system's sensitivity to depolarizing channel noise and validated that reconstruction errors remain negligible ($<10^{-5}$), confirming that masking does not degrade aggregation accuracy.

4. Experimental Results

The framework was evaluated against a baseline (plain aggregation) and a classical secure aggregation (PRG-based) across varying numbers of clients ($K=3, 10, 20$).

• Utility Preservation (Accuracy):

  • Channel Estimation: Secure FL (QKD-SA) achieved an NMSE of 0.216, nearly identical to the baseline (0.2162).
  • Radar Sensing: Secure FL achieved 92.1% accuracy and 0.72 mIoU, slightly outperforming or matching the plain baseline in most scenarios.
  • Conclusion: Pairwise masking introduces no aggregation bias; the global model quality is preserved.

• Security Effectiveness (Threat Model):

  • When an eavesdropper (Eve) was introduced, the QBER rose to ~25% (well above the 8–11% threshold).
  • Result: All rounds were aborted. The model did not update, and accuracy remained at the random-guessing level (e.g., 6.96% for radar), proving the system successfully prevents aggregation under attack.

• Leakage Analysis:

  • Reconstruction Error: The difference between the plain average and masked average was negligible ($\sim 10^{-7}$ for channel, $\sim 10^{-5}$ for radar), confirming mathematical correctness.
  • Leakage Proxies: Cosine similarity and Pearson correlation between true updates and masked updates decreased over rounds (e.g., from 0.94 to 0.83), indicating that the masks effectively obfuscate individual contributions.

5. Significance and Future Work

• Significance: This work demonstrates the feasibility of information-theoretically secure Federated Learning for critical 6G infrastructure. It proves that QKD can protect model updates without sacrificing the utility required for high-performance tasks like channel estimation and radar sensing. The "abort-on-error" mechanism provides a robust defense against active eavesdropping.
• Limitations & Future Work:
  • The study uses a protocol-level abstraction of QKD; future work must address physical-layer implementation (e.g., fiber or free-space channels) and Measurement-Device-Independent (MDI) QKD to remove detector side-channel assumptions.
  • The radar dataset is relatively small (200 samples); larger-scale evaluations are needed.
  • Future research should combine QKD-seeded masking with formal privacy guarantees (e.g., Differential Privacy) and Byzantine fault tolerance.

In summary, the paper presents a robust, secure FL architecture that leverages quantum mechanics to ensure privacy in 6G networks, successfully balancing high model accuracy with rigorous protection against eavesdropping.