Zero-Knowledge Proof

If the statement is true, an honest prover can always convince an honest verifier. In a federated learning context, this means a base station that correctly computed a gradient descent step on its local data will always be able to generate a valid proof of correct computation. The verifier (aggregation server) will accept the proof with probability 1. This property ensures that legitimate model updates are never falsely rejected, maintaining the integrity of the collaborative training process. Key implication: No false negatives in the verification of model updates.

If the statement is false, no cheating prover can convince an honest verifier, except with some negligible probability. This is the security backbone that prevents malicious base stations from submitting corrupted or backdoored model updates. A computationally bounded adversary cannot forge a proof that a poisoned gradient is legitimate. Computational soundness relies on cryptographic hardness assumptions (e.g., discrete logarithm), while statistical soundness provides unconditional guarantees. In practice, this prevents Byzantine actors from injecting faulty updates into the global model without detection.

The verifier learns absolutely nothing about the prover's private input beyond the validity of the statement itself. This is formalized through the existence of a simulator that can generate transcripts indistinguishable from real protocol interactions without access to the secret. For telecom federated learning, this means the central aggregator can verify that a local model update is correctly computed without ever seeing the raw user mobility data, call records, or even the gradient values. Perfect zero-knowledge ensures statistical indistinguishability; computational zero-knowledge relies on hardness assumptions.

A property of modern zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) where the proof size is constant or logarithmic relative to the computation being verified, and verification time is exponentially faster than re-executing the computation. For a base station proving it trained a neural network on millions of data points, the proof might be only a few hundred bytes and verifiable in milliseconds. This is critical for bandwidth-constrained RAN environments where transmitting full model updates is already expensive. Key metrics: Proof size often < 1 KB; verification time < 10 ms.

Traditional ZKPs required multiple rounds of challenge-response messages between prover and verifier. Non-interactive zero-knowledge proofs (NIZKs) collapse this into a single message from prover to verifier, typically using the Fiat-Shamir heuristic to replace the verifier's random challenges with a cryptographic hash function. In federated learning, this is essential: a base station can generate a proof of correct training offline and attach it to the model update in a single transmission. The aggregation server verifies all proofs asynchronously without maintaining stateful sessions with hundreds of edge nodes.

A stronger notion where the prover demonstrates not just that a statement is true, but that they possess a specific witness (secret input) that makes it true. This is formalized through an extractor algorithm that can recover the witness from a successful prover. In the federated learning setting, a base station proves knowledge of the local dataset and the correct gradient computation that produced the update, not merely that some valid update exists. This prevents replay attacks where an adversary submits a previously valid proof without actually performing the local training. Relevance: Binds the proof to the actual computation.

A cryptographic primitive that allows computations to be performed directly on encrypted ciphertext, generating an encrypted result that, when decrypted, matches the output of operations performed on the original plaintext. Unlike ZKPs, which prove a statement's validity without revealing the secret, fully homomorphic encryption (FHE) enables arbitrary computation on encrypted data. In federated learning, HE can protect model updates during aggregation, while ZKPs verify the correctness of those computations without the server seeing the plaintext updates.

A subfield of cryptography that enables multiple distrusting parties to jointly compute a function over their private inputs while ensuring those inputs remain secret from one another. SMPC can replace a trusted central aggregator in federated learning by distributing the aggregation logic across participants. ZKPs complement SMPC by allowing each party to prove they executed the agreed-upon computation correctly without revealing their local model weights, addressing the Byzantine fault tolerance challenge.

A privacy breach where an adversary exploits access to a trained machine learning model and its confidence scores to reconstruct representative features or specific records from the model's private training dataset. In federated learning, even aggregated model updates can leak sensitive information. ZKPs mitigate this by allowing a client to prove their update was computed on legitimate data without exposing the update's gradients, reducing the attack surface for gradient leakage and feature reconstruction.

A mathematical framework that quantifies the privacy guarantee of a data analysis by ensuring the output of a computation does not reveal whether any single individual's data was included in the input, typically achieved by injecting calibrated statistical noise. While DP limits information leakage through the privacy budget (epsilon), ZKPs provide a complementary guarantee: proving that the noise was correctly applied according to the declared privacy parameters without revealing the pre-noise values.

A cryptographic protocol that ensures a central server can only compute the sum of encrypted model updates from multiple clients, preventing the server from inspecting any individual client's contribution during federated learning. ZKPs extend this guarantee by enabling each client to generate a non-interactive zero-knowledge proof that their encrypted update falls within a valid range or was derived from a legitimate local training process, preventing malicious clients from submitting poisoned updates that would corrupt the aggregate.

The resilience property of a distributed system that enables it to reach correct consensus and continue operating reliably even when an arbitrary subset of nodes exhibits malicious or arbitrarily faulty behavior. In federated learning, Byzantine clients can submit arbitrary or crafted updates to corrupt the global model. ZKPs provide a computational integrity guarantee: each client proves their update is the result of a valid training procedure, transforming Byzantine faults into detectable failures and enabling robust aggregation.