💻 computer science

HashGuard-FL: Learnable Hash-Based GAN Discriminator with Post-Quantum Audit Trail for Federated Learning Integrity

HashGuard-FL is a novel federated learning framework that integrates a learnable hash-based GAN discriminator for fine-grained, multi-class attack detection with a post-quantum audit layer using SHAKE-256 and CRYSTALS-Dilithium signatures to ensure tamper-evident, quantum-resistant integrity across diverse benchmarks.

Original authors: Nilima Dongre

Published 2026-07-09

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Nilima Dongre

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a massive, global cooking competition where chefs (clients) are scattered all over the world, each with their own secret family recipes. Instead of sending their actual ingredients (which might be private or sensitive), they send you a description of how they changed their dish (the model update) so you can mix them all into one giant, super-delicious stew (the global model). This is Federated Learning.

But here's the catch: some chefs are saboteurs. They might try to sneak in a bag of salt when they promised sugar, or they might send you a recipe from last week pretending it's new, or they might just send a recipe that makes no sense at all. If you let these bad updates in, your whole stew could turn into a disaster.

For a long time, security guards tried to catch these saboteurs by measuring the "weight" of the recipe descriptions. If a description was too heavy or too light, they'd toss it. But the paper argues this is like trying to catch a thief by weighing their shoes; if the thief wears heavy boots (or if the honest chefs just happen to have heavy ingredients because they live in different places), the guard gets confused and lets the bad guys in. The paper explicitly rules out relying on these simple weight checks, especially when the chefs have very different ingredients (non-IID data).

Enter HashGuard-FL, a new security system that acts like a super-smart, futuristic bouncer with a magic scanner.

The Magic Scanner: Turning Recipes into Fingerprints

Instead of looking at the whole recipe, HashGuard-FL uses a special tool called a Locality-Sensitive Hash. Think of this as a machine that takes a complex, 100-page recipe and instantly turns it into a tiny, 128-bit digital fingerprint (a string of 1s and 0s).

Here's the clever part: this machine is designed so that if two recipes are similar, their fingerprints are similar. If they are totally different, the fingerprints are totally different. Crucially, once the recipe is turned into this fingerprint, you can't turn it back into the original recipe. This keeps the chefs' secret ingredients safe while still letting the bouncer check if the update looks suspicious. The paper shows that this method is much better at spotting bad actors than just weighing the updates, especially when the honest chefs are all doing things differently.

The Bouncer with a Crystal Ball: The GAN

Once the recipes are fingerprints, they go to the bouncer, which is actually a GAN (Generative Adversarial Network). Imagine a bouncer who doesn't just memorize a list of "bad guys." Instead, this bouncer has a partner, a "forger," who tries to create fake fingerprints that look exactly like the real ones.

The bouncer and the forger play a constant game of cat-and-mouse. The forger tries to trick the bouncer, and the bouncer learns to spot the trick. Because the bouncer has trained against this forger, it becomes incredibly good at spotting even the sneakiest, most adaptive attacks. The paper simulates this training and finds that this "adversarial" approach is much tougher than older methods that just look for statistical outliers.

The Five Types of Trouble

The system is smart enough to sort trouble into five specific buckets, not just "good" or "bad":

Benign (C0): The honest chef.
Poisoned (C1): The chef trying to ruin the dish on purpose.
Unstable (C2): The chef whose recipe is just chaotic or broken (maybe their computer crashed).
Replayed (C3): The chef trying to sneak in an old recipe from last month.
Tampered (C4): The chef who quietly changed a few letters in the recipe.

Old systems often missed the "Replayed" or "Tampered" types, but HashGuard-FL catches them. In tests across four different scenarios (from recognizing digits to reading heartbeats), this system caught bad updates with a macro-F1 score of 0.962 and an AUROC of 0.989. That's a huge jump over the previous best methods, which only scored around 0.85. It adds a tiny delay of just 2.3 milliseconds per round, which is barely noticeable.

The Unbreakable Diary: Post-Quantum Audit

Here is the most futuristic part. Every time the bouncer makes a decision, it writes it down in a digital diary. But this isn't just any diary; it's protected by Post-Quantum Cryptography.

The paper argues that current security locks (like RSA) are like paper locks that a future super-computer (a quantum computer) could pick easily. Since medical models might be used for decades, we need a lock that even a quantum computer can't break. HashGuard-FL uses a new type of lock called ML-DSA-65 and a special hashing tool called SHAKE-256.

The paper simulates a 500-round clinical trial (like a 24-month hospital study) and shows that this diary remains tamper-proof. Even if a bad actor tries to change the diary later, the math proves they can't. The audit log for 500 rounds is only 1.3 MB and can be verified in 4.2 seconds on a regular computer.

What the Paper Doesn't Claim

It's important to know what this system doesn't do yet. The paper admits that the system needs a "warm-up" period of 20 rounds of clean data before it starts working well. It also notes that if a hacker somehow figures out the exact settings of the magic scanner, they might try to trick it again, so the authors suggest making the scanner change randomly in the future. Finally, while the system worked perfectly in a computer simulation of a hospital, the paper hasn't tested it in a real, live hospital yet.

The Bottom Line

HashGuard-FL is a new way to keep Federated Learning safe. It swaps out old, clumsy weight-checks for a smart fingerprint scanner, trains a bouncer to fight against a forger, and writes everything down in a diary that quantum computers can't break. In the simulations, it caught almost every bad actor, kept the system running fast, and promised that the record of what happened will stay true for decades. It's a big step forward, but the authors remind us that real-world testing is the next big challenge.

Technical Summary: HashGuard-FL

Problem Statement

Federated Learning (FL) in safety-critical domains faces two intertwined integrity challenges that existing solutions fail to address simultaneously:

Runtime Detection: Current Byzantine-robust aggregation rules and gradient anomaly detectors struggle under non-IID (non-identically distributed) data conditions. They often misclassify legitimate updates from data-poor clients as anomalies or fail to detect adaptive attacks that mimic benign statistics. Furthermore, existing methods typically offer only binary (accept/reject) decisions, lacking the granularity to distinguish between different attack types (e.g., poisoning vs. hardware faults).
Long-term Auditability: Traditional cryptographic provenance schemes rely on classical signatures (e.g., RSA, ECDSA) which are vulnerable to future quantum adversaries. Given that clinical and industrial AI models may operate for decades, an audit trail signed today could be retrospectively forged once quantum computers become available. There is a lack of integrated frameworks that provide both fine-grained detection and post-quantum secure audit trails.

Methodology: HashGuard-FL

HashGuard-FL is a framework that couples a learnable hash-based GAN discriminator with a post-quantum audit layer. The system operates through the following components:

1. Hash Projection Layer

To address the high-dimensional variance caused by non-IID data, the system projects client updates ( $\delta w$ ) into a compact 128-bit locality-sensitive hash (LSH) space.

Mechanism: It uses signed random projections ( $H_i(\delta w) = \text{sign}(r_i^T \cdot \delta w / \|\delta w\|)$ ) where $r_i$ are fixed Gaussian vectors.
Privacy & Robustness: The projection is irreversible (protecting raw gradients) and L2-normalization removes magnitude information, which is the primary confounder for norm-based detectors under non-IID conditions. This leaves the angular structure of updates as the primary detection signal.
Embedding: A 32-dimensional learned embedding is appended to the 128-bit hash, creating a 160-dimensional descriptor for the discriminator.

2. GAN-Based Discriminator

The core detector is a Generative Adversarial Network (GAN) trained in the compressed hash space.

Architecture: A discriminator ( $D_\theta$ ) with four fully connected layers (160-512-256-128-5) uses spectral normalization to ensure Lipschitz continuity and training stability.
Training Objective: The model is trained using a composite loss function:
- Cross-Entropy Loss ( $\mathcal{L}_{cls}$ ): For multi-class classification.
- Adversarial Loss ( $\mathcal{L}_{adv}$ ): A generator ( $G_\phi$ ) synthesizes adversarial hash embeddings to fool the discriminator, providing an implicit robustness guarantee against adaptive attacks.
- Contrastive Loss ( $\mathcal{L}_{ctr}$ ): A supervised contrastive term pulls embeddings of the same class together and pushes different classes apart, improving separation of visually similar attack types.
Classification: The system classifies updates into five operationally defined classes:
- C0: Benign
- C1: Poisoned (Label-flip + scaling)
- C2: Unstable (Cauchy/NaN)
- C3: Replayed (Stale updates)
- C4: Tampered (Bit-flip/structured noise)
Aggregation Gate: Decisions are mapped to actions: Accept (C0), Quarantine (C2, C4 for further inspection), or Reject (C1, C3).

3. Post-Quantum Audit Trail

To ensure long-term integrity, the system commits every round's decision to a tamper-evident transcript.

Construction: A round record is hashed using SHAKE-256 (an extendable-output function) and chained to the previous round's hash.
Signing: The hash is signed using ML-DSA-65 (CRYSTALS-Dilithium), a NIST-standardized post-quantum signature scheme (FIPS 204) providing 128-bit quantum security.
Verification: The resulting transcript is lightweight (approx. 1.3 MB for 500 rounds) and verifiable on commodity hardware.

Key Contributions

Five-Class Attack Taxonomy: The paper formalizes a unified detection framework distinguishing between benign, poisoned, unstable, replayed, and tampered updates, enabling differentiated responses (quarantine vs. reject) rather than binary decisions.
LSH Projection for Non-IID Robustness: It introduces a locality-sensitive hash projection that neutralizes distributional variance, allowing the detector to focus on angular geometry rather than magnitude, which is critical for non-IID environments.
Adversarial GAN Training: By coupling a discriminator with a generator in the hash space, the system learns a decision boundary robust to adaptive attack synthesis, outperforming static statistical detectors.
Post-Quantum Audit Infrastructure: It implements the first FL integrity mechanism to use NIST-standardized post-quantum signatures (ML-DSA-65) and SHAKE-256, ensuring audit trails remain verifiable against future quantum adversaries.
Comprehensive Evaluation: The framework is validated across four benchmarks (MNIST, CIFAR-10, FEMNIST, PTB-XL ECG) and a simulated 500-round clinical deployment.

Results

Performance: On the CIFAR-10 dataset with 20% Byzantine clients under extreme non-IID conditions, HashGuard-FL achieved a macro-F1 of 0.962 and an AUROC of 0.989.
Comparison: It outperformed eight baselines (including Krum, FLTrust, and Flame) by up to 0.111 F1 points. Notably, it significantly improved detection of minority classes (Replayed and Tampered) which are often invisible to norm-based detectors.
Efficiency: The system adds only 2.3 ms of overhead per round.
Clinical Simulation: In a 500-round simulation of an ECG classification task, the system maintained a stable False Positive Rate (FPR) of 0.034 and successfully detected all injected attack windows within two rounds of onset, even when attackers switched strategies.

Significance and Claims

The paper claims that HashGuard-FL addresses a critical gap in FL security by integrating detection and auditability into a single framework. Its significance lies in three design choices:

Decoupling Privacy and Detection: By using deterministic hash projection instead of additive noise (as in Differential Privacy), it preserves the structural information needed for detection while ensuring raw gradients are never exposed.
Implicit Robustness: The adversarial training loop provides a "worst-case" guarantee against adaptive attacks that the generator can synthesize, a capability static detectors lack.
Temporal Security: By adopting post-quantum primitives, the framework ensures that integrity guarantees survive the multi-decade lifespans of clinical AI models, addressing the "harvest now, decrypt later" threat posed by quantum computing.

The authors acknowledge limitations, including the requirement for 20 "warm-up" rounds of clean data, the use of a fixed projection matrix (which could theoretically be inferred by an adaptive attacker), and the need for real-world clinical validation beyond simulation. However, they position the work as a foundational step toward quantum-resilient, fine-grained FL integrity.