Zero-Knowledge Proof (ZKP)

If the statement is true and both parties follow the protocol honestly, an honest verifier will always be convinced by an honest prover.

• Guarantee: No false negatives. A correctly computed model update will always pass verification.
• Mechanism: The proof construction follows a deterministic mathematical relationship that maps a valid witness to an irrefutable cryptographic commitment.
• Federated Context: A hospital proving it trained a model on genuine patient data without data poisoning will always succeed if the computation was honest.

If the statement is false, no cheating prover can convince an honest verifier that it is true, except with some negligible probability.

• Guarantee: No false positives. A malicious actor cannot fabricate a valid proof for a fraudulent computation.
• Mechanism: The protocol forces the prover to commit to a fixed computation before the verifier issues a random challenge, making it computationally infeasible to forge a proof.
• Federated Context: A compromised client cannot submit a poisoned model update and falsely claim it was trained correctly on clean data.

The verifier learns absolutely nothing about the prover's private input (the witness) beyond the single bit of information: 'the statement is true.'

• Guarantee: The proof reveals zero information about the underlying data, model weights, or training process.
• Mechanism: A simulator can generate a transcript indistinguishable from a real interaction without access to the private witness, proving no knowledge is leaked.
• Federated Context: A central aggregator can cryptographically verify that a local model update satisfies convergence criteria without ever seeing the raw patient data or the local model's exact gradients.

The proof is extremely small in size and can be verified exponentially faster than re-executing the original computation.

• Guarantee: Verification is lightweight and practical, even for complex deep learning computations.
• Mechanism: Modern zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) produce proofs of constant or logarithmic size relative to the computation, verifiable in milliseconds.
• Federated Context: A resource-constrained edge device can generate a compact proof that a model update was computed correctly, and the aggregation server can verify hundreds of such proofs with minimal overhead.

The proof can be generated once by the prover and verified by anyone at any time without requiring back-and-forth communication.

• Guarantee: The prover creates a single, self-contained proof artifact that any verifier can check independently.
• Mechanism: The Fiat-Shamir heuristic converts an interactive protocol into a non-interactive one by replacing the verifier's random challenges with the output of a cryptographic hash function applied to the prover's commitments.
• Federated Context: A hospital generates a single ZKP attesting to the integrity of its local training round and broadcasts it alongside the model update; any auditor can verify it asynchronously without engaging the hospital directly.

The proof attests that a specific computation was executed exactly as prescribed, transforming a given public input and private witness into a specific public output.

• Guarantee: The verifier is assured of the correctness of the computation itself, not just the validity of a static statement.
• Mechanism: The computation is expressed as an arithmetic circuit, and the ZKP proves that there exists a valid assignment of values to all circuit wires that satisfies every gate constraint.
• Federated Context: A client proves that global_model_update = FederatedAveraging(local_data, initial_global_weights) was executed faithfully, without revealing local_data. This directly mitigates free-rider and Byzantine attacks.

A cryptographic scheme that allows computation directly on ciphertexts, generating an encrypted result that, when decrypted, matches the output of operations performed on the plaintext. Unlike ZKPs, which prove computation correctness, HE enables actual computation on hidden data.

• Fully Homomorphic Encryption (FHE) supports arbitrary computation but is computationally intensive
• Partially Homomorphic Encryption (PHE) supports only addition or multiplication
• Often combined with ZKPs to provide both confidential computation and verifiable correctness

A protocol enabling multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. ZKPs can be used within SMPC to ensure each party follows the protocol honestly.

• Secret sharing splits data into meaningless fragments distributed across parties
• Garbled circuits enable secure two-party computation via encrypted boolean gates
• Critical for cross-silo federated learning where hospitals jointly compute without exposing patient data

A mathematical framework providing a provable guarantee against information leakage by adding calibrated noise to data or model outputs. While ZKPs prove correctness, DP limits what can be inferred about any single individual in the dataset.

• Epsilon (ε) quantifies the privacy loss budget—lower values mean stronger privacy
• Local DP adds noise on the client device before data leaves
• Global DP adds noise to the aggregated output on a trusted server
• Often paired with ZKPs to ensure the noise was correctly applied without revealing the raw data

A privacy breach where an attacker reconstructs sensitive training data or statistical features from a model's parameters or confidence scores. ZKPs can mitigate this by proving a model was trained correctly without exposing its internal weights.

• Attackers exploit confidence scores to iteratively reconstruct class representatives
• Gradient leakage is a specific form occurring during federated training
• ZKP-based proof of training integrity assures verifiability without revealing model internals

A cryptographic protocol allowing a central server to compute the sum of model updates from multiple clients without inspecting any individual contribution. ZKPs can verify that each client's encrypted update was computed on genuine local data.

• Uses secret sharing to mask individual updates before transmission
• The server only learns the aggregate sum, never individual gradients
• ZKPs add a layer of computational integrity—proving the update was derived from a valid training process without revealing the data

The resilience of a distributed system to arbitrary failures or malicious actors sending conflicting information. ZKPs provide a cryptographic mechanism to prove honest behavior in Byzantine-prone environments.

• Byzantine nodes may submit poisoned gradients or violate protocol rules
• Robust aggregation rules like Krum discard statistical outliers
• ZKPs enable verifiable computation—a node proves its update is correctly formed without revealing the underlying data, making Byzantine behavior detectable