💻 computer science

Federated Learning Parameter Protection Based on Homomorphic Encryption and Selective User Decryption

This paper proposes a federated learning security scheme that combines threshold Paillier homomorphic encryption with a data quality-based selective decryption mechanism and ECDSA signatures to effectively defend against inference and tampering attacks while improving training efficiency by approximately 10%.

Original authors: Zhangbing Li, Mingyu Xiao, Jiantian Xiao, Jinsheng Li, Shaobo Zhang

Published 2026-07-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhangbing Li, Mingyu Xiao, Jiantian Xiao, Jinsheng Li, Shaobo Zhang

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, high-stakes group project where hundreds of students (the "users") are trying to build the world's smartest AI brain together. But there's a catch: they can't share their actual homework (their private data) with each other or the teacher (the "server"). They have to send in their answers without anyone seeing the questions they worked on.

This is the world of Federated Learning. But here's the problem: some students are sneaky. They might try to peek at others' answers, or they might be lazy and submit garbage work that slows the whole class down.

The paper by Zhangbing Li and his team at Hunan University of Science and Technology proposes a clever new way to run this class. They call it a Federated Learning model parameter protection scheme based on threshold homomorphic encryption and selective user decryption. That's a mouthful, so let's break it down with some fun analogies.

The Magic Lockbox (Homomorphic Encryption)

First, imagine every student puts their homework answer into a magical, unbreakable lockbox. This is Homomorphic Encryption. The cool part? The teacher can still add up all the lockboxes together to get a total score without ever opening them. The math happens inside the locked boxes. This stops the teacher (who is "honest but curious") from stealing the answers.

But wait, what if the teacher is actually a spy, or a group of students gangs up to break the lock? That's where the next trick comes in.

The Secret Key Split (Threshold Encryption)

In the old days, one person held the master key to open all the boxes. If that person got hacked or turned evil, the whole system crashed.

The authors suggest a better way: Splitting the key. Imagine the master key is cut into 100 tiny puzzle pieces. Every student gets one piece. To open the final box and see the result, you don't need everyone; you just need a specific number of pieces, say 10 (this is the "threshold").

If a bad guy steals 5 pieces, they can't open the box. If the teacher tries to peek, they have zero pieces. The box only opens when at least 10 different students work together to combine their puzzle pieces. This stops anyone from acting alone to steal the data.

The "Top Students" Club (Selective Decryption)

Here's the real game-changer. In a normal class, everyone helps open the boxes. But what if some students have bad internet, slow computers, or are just trying to sabotage the project with low-quality answers? They slow everything down.

The authors suggest a Data Quality Evaluation. Before the boxes are opened, the system checks who did the best work. It looks at how close their answers were to the "perfect" answer and how consistent their direction was.

Then, it picks only the Top-t (the top 10) students with the highest-quality data to do the actual opening of the boxes.

Why? Because these "Top Students" are reliable, have fast computers, and their answers are actually helpful.
The Result: The system ignores the slow or sneaky students for the heavy lifting. This makes the whole class finish the project faster.

The Digital ID Badge (ECDSA Signatures)

To make sure no one swaps the homework or pretends to be someone else, every student and the teacher wears a Digital Signature badge (using ECDSA technology). It's like a wax seal on an envelope. If anyone tries to tamper with the message, the seal breaks, and the system knows to throw it out.

What the Experiments Showed

The authors ran simulations using famous image datasets (MNIST, Fashion-MNIST, and CIFAR-10) to see if their idea worked. Here is what they found:

Speed: Their method was about 10% faster at reaching a stable result compared to other encryption methods. For example, on the MNIST dataset, their model needed 63 rounds of training to finish, while a standard encryption method needed 70 rounds.
Privacy: They tested if a hacker could reconstruct the original images from the locked boxes.
- With their method, the reconstructed images were a mess. The "Peak Signal-to-Noise Ratio" (a measure of image quality) was only 11.38 dB for MNIST.
- Compare that to a standard method without encryption, where the image was crystal clear at 34.26 dB.
- The "Label Extraction Accuracy" (how often a hacker guessed the right answer) dropped to 7.3% with their method, which is basically just guessing.
Robustness: Even when they simulated a classroom where 30% of the students were trying to sabotage the project (malicious attacks), their method still managed to converge and finish the task, whereas other methods crashed or slowed down significantly.

What They Don't Claim

It's important to note what this paper doesn't say:

They do not claim this is a "perfect" solution that eliminates all costs. In fact, they admit their method takes more time and more data to send than methods without encryption.
They do not say this works on physical hardware attacks (like someone stealing a hard drive). Their security is based on the math of the encryption, not on physical security.
They do not claim the accuracy is higher than non-encrypted methods. In fact, their accuracy was slightly lower (e.g., 97.35% vs 97.55% on MNIST testing), but they argue this tiny drop is a fair price to pay for safety.

The Bottom Line

The authors suggest that by splitting the secret key and only letting the "best" students open the boxes, you can build a Federated Learning system that is safer against sneaky hackers and faster against lazy or broken computers.

It's a trade-off: you spend a little more computing power and time (about 25% to 60% more depending on the key size) to get a system that doesn't collapse when bad actors show up. In their simulations, this approach successfully balanced the need for privacy with the need for a working, fast AI model.

Technical Summary: Federated Learning Parameter Protection Based on Homomorphic Encryption and Selective User Decryption

1. Problem Statement

The paper addresses two critical vulnerabilities in existing Federated Learning (FL) systems:

Privacy Leakage and Inference Attacks: Current security schemes often rely on basic encryption or participant reliability, which fails to effectively defend against sophisticated attacks such as member inference, attribute reasoning, and model reversal. Malicious or semi-honest servers can analyze gradient updates to reconstruct original user data or infer sensitive information.
System Instability and Efficiency Loss: Low-quality data users, characterized by unreliable infrastructure, unstable networks, or malicious motives (e.g., poisoning attacks), degrade training speed, interfere with aggregation efficiency, and threaten the stability of the entire FL ecosystem. Traditional encryption methods often lack mechanisms to filter these users, leading to inefficient convergence and potential model contamination.

2. Methodology

The authors propose a comprehensive FL parameter protection framework that integrates Threshold Homomorphic Encryption, Data Quality Evaluation, and Digital Signatures. The system architecture involves a Certification Center, a Federated Learning Center (Server), and multiple Node Users.

Core Components:

Distributed Paillier Homomorphic Encryption:
- The system utilizes a $(t, n)$ -threshold mechanism based on the Paillier cryptosystem.
- The private key is split using secret sharing technology (Shamir's Secret Sharing) into $n$ partial keys distributed among users.
- Security Guarantee: No single entity (including the server) holds the complete private key. Decryption requires the collaboration of at least $t$ users, mitigating single points of failure and resisting collusion attacks where the number of malicious participants is less than $t$ .
- Additive Homomorphism: Allows the server to aggregate encrypted gradients ( $E(g^*) = \prod E(g_i)$ ) without decrypting them, preserving data confidentiality during the aggregation phase.
Selective User Decryption based on Data Quality:
- To address efficiency and robustness, the system does not require all users to participate in decryption. Instead, it selects the top- $t$ users with the highest data quality.
- Evaluation Metrics: Data quality is assessed using two covariates:
  1. Data Dispersion ( $d$ ): The Euclidean distance between the user's local gradient and the global optimal gradient.
  2. Gradient Similarity ( $v$ ): The cosine similarity between the local and global gradient vectors.
- Composite Score ( $Q$ ): A composite evaluation value $Q = d \cdot v$ is calculated. Users with high $Q$ values (indicating small dispersion and high directional consistency) are selected as "active contributors" to perform the partial decryption tasks. This filters out low-quality or malicious updates before they impact the global model.
Digital Signature and Integrity:
- The Elliptic Curve Digital Signature Algorithm (ECDSA) is employed for end-to-end authentication.
- Users sign their encrypted gradients and partial decryption results. The server verifies these signatures to ensure the integrity of parameters and prevent tampering or replay attacks during transmission.

Workflow:

Initialization: The Certification Center generates keys, splits the private key, and distributes public keys and partial private keys to users.
Local Training: Users train locally, compute gradients, evaluate data quality, encrypt gradients, and sign the data.
Aggregation: The server aggregates encrypted gradients and verifies signatures.
Selection & Decryption: The server selects the top- $t$ high-quality users. These users perform partial decryption on the aggregated ciphertext using their key shares.
Final Reconstruction: The server aggregates the partial decryption results to recover the plaintext global gradient and updates the model.

3. Key Contributions

The paper outlines three primary contributions:

Threshold-Based Key Segmentation: A method for aggregating model parameters using a distributed Paillier system where decryption rights are limited to a threshold $t$ . This eliminates the risk of a single private key holder and resists collusion attacks, ensuring parameters remain encrypted throughout the process.
Quality-Driven Decryption Selection: A novel mechanism that selects decryption participants based on data quality evaluation (dispersion and similarity). This ensures that only high-quality, trustworthy nodes participate in the computationally intensive decryption task, thereby improving training efficiency and model accuracy while filtering out malicious or low-quality inputs.
Performance Validation: Experimental results demonstrating that the proposed scheme achieves faster model convergence (approximately 10% higher efficiency) compared to existing homomorphic encryption schemes, with comparable accuracy, while effectively resisting inference and poisoning attacks.

4. Experimental Results

The authors evaluated the scheme on MNIST, Fashion-MNIST, and CIFAR-10 datasets under Non-IID conditions, comparing it against FedAvg, FedBN, Fed_Paillier, PL_FedIPEC, and THFed.

Privacy Protection:
- Gradient Inversion Resistance: The proposed scheme significantly reduced the Peak Signal-to-Noise Ratio (PSNR) of reconstructed images compared to plaintext (FedAvg) and other encryption schemes. For example, on MNIST, the PSNR dropped from 34.26 dB (FedAvg) to 11.38 dB (Proposed), indicating attackers cannot recover meaningful data.
- Label Extraction: Label extraction accuracy was reduced to near-random guessing levels (e.g., 7.3% on MNIST vs. 100% for FedAvg).
- Structural Similarity (SSIM): The scheme achieved the lowest SSIM values (e.g., 0.21 on MNIST), confirming minimal structural information leakage.
Convergence and Accuracy:
- Convergence Speed: The proposed scheme required fewer iterations to converge. On MNIST, it converged in 63 rounds compared to 68 for FedAvg and 70 for Fed_Paillier, representing a ~10% improvement in learning efficiency.
- Accuracy: The scheme maintained high accuracy (e.g., 97.74% on MNIST), comparable to other privacy-preserving methods and only slightly lower than the non-private Centralized baseline.
- Robustness: Under malicious attack scenarios (up to 30% attack range and 0.4 severity), the proposed scheme maintained stable convergence and accuracy, showing significantly less performance degradation than baseline methods.
Overhead:
- Computation: The scheme incurs higher computational overhead than non-encrypted baselines due to encryption/decryption and signature verification. However, it is comparable to or slightly higher than other homomorphic schemes (e.g., ~10% higher than THFed) due to the added quality evaluation and multi-party decryption steps.
- Communication: Communication overhead is linearly correlated with the number of users and key size. The scheme requires slightly more bandwidth than gradient-pruning schemes (like THFed) due to the transmission of decryption results and signatures, but avoids the accuracy loss associated with gradient pruning.

5. Significance and Claims

The paper claims that its proposed framework successfully balances the trade-off between security, efficiency, and accuracy in Federated Learning.

Security: By combining threshold cryptography with selective decryption, the system effectively defends against member inference, model reversal, and server-side tampering, ensuring that even a semi-honest server cannot access raw user data.
Efficiency: The introduction of a data quality evaluation mechanism allows the system to dynamically select the most reliable nodes for decryption. This not only accelerates model convergence by filtering out noisy or malicious updates but also optimizes resource allocation.
Trustworthiness: The integration of digital signatures ensures the integrity of the entire communication pipeline, from local updates to global aggregation.

The authors conclude that this approach provides a robust solution for building secure and trustworthy data-sharing environments, particularly in scenarios where data heterogeneity and potential malicious behavior are significant concerns. They acknowledge that while the scheme introduces computational overhead, the trade-off is justified by the enhanced security and improved convergence stability. Future work is suggested to explore hardware acceleration and sparsified encryption to further optimize costs.