Auditable Session Admission for Cross-Silo Federated Learning
This paper presents a session admission gateway for cross-silo federated learning that enforces auditable, pre-approved session capabilities through signed tokens and cryptographic request binding, enabling stateless, replay-resistant access control at organizational boundaries.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a world where hospitals, banks, and research labs want to build a super-smart AI together, but they can't share their secret data. It's like trying to bake a giant cake where everyone brings their own secret ingredient, but no one is allowed to leave their kitchen. This is the promise of Federated Learning: a way to train a shared model without ever moving the raw data. But here's the sticky part: once the team decides to start baking, how do they make sure only the right people are allowed to mix the batter, taste the cake, or even decide when the oven is hot enough? In the real world, these rules are often written in messy, confusing code that changes without warning, making it impossible to prove later who was allowed to do what. This paper tackles that exact problem: how to create a secure, unbreakable "guest list" for these digital baking parties that everyone can trust and audit later.
The authors, Enzo Fenoglio and Philip Treleaven from University College London, propose a clever solution called a Session Admission Gateway. Think of it as a high-tech bouncer standing at the door of a VIP club. In their system, before any organization can join a training session, they get a special, signed digital pass called a Session Capability Token (SCT). This isn't just a generic ID card; it's a specific list of permissions for this specific party. It says, "You, Hospital A, are allowed to fetch the current model and submit updates, but you are not allowed to end the session."
But here's the twist that makes it truly secure: the token alone isn't enough. If a hacker steals that token, they can't use it. Why? Because every time someone tries to enter, they must also prove they actually hold the key that matches the token. This is called Proof-of-Possession (PoP). It's like having a VIP wristband that only works if you can also show a matching tattoo that changes every time you walk through the door. If the wristband and the tattoo don't match perfectly, the bouncer (the gateway) slams the door shut.
The paper demonstrates this with a working prototype using a classic AI test called MNIST (recognizing handwritten numbers). They simulated a cross-silo environment where different organizations tried to join. The results showed that the system works exactly as intended:
- It blocks the bad guys: When they tried to use a stolen token without the matching key, or tried to do something they weren't allowed to (like an admin trying to fetch a model instead of ending the session), the gateway instantly said "DENY."
- It leaves a paper trail: Every single decision—whether it was a "YES" or a "NO"—is written down in a structured log with cryptographic hashes. This means later, auditors can look at the logs and say, "Yes, at 2:00 PM, Hospital B was allowed to submit an update because they had the right token and the right key," without needing to guess or dig through messy server configurations.
- It's fast: The system is incredibly efficient. The authors measured that checking a request takes less than a millisecond (specifically, a median of 0.261 ms for an allowed request). This is so fast that it doesn't slow down the actual AI training process at all.
The paper is careful to note what it doesn't do. It doesn't try to hide the data itself (that's a different job for privacy tools) or stop hackers from poisoning the AI model. It also doesn't replace the internal security systems that hospitals and banks already use to manage their own employees. Instead, it acts as a universal translator and gatekeeper between them, ensuring that when they talk to each other, the rules are clear, the permissions are checked in real-time, and the evidence is undeniable. By turning authorization into a simple, stateless check of a token and a key, the authors suggest a way to make cross-organization AI collaboration less brittle and much more trustworthy.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.