Digital Signature

Digital signatures enable the central aggregation server to cryptographically verify that each model update originated from a legitimate, registered client. This prevents Sybil attacks where an adversary floods the protocol with fake clients to poison the global model.

• Binds a client's unique identity to their submitted update
• Relies on a Public Key Infrastructure (PKI) to distribute and manage verification keys
• Prevents unauthorized entities from injecting arbitrary gradients

In practice, a client signs their encrypted update with their private key, and the server verifies the signature using the client's public key before accepting the contribution for aggregation.

A digital signature guarantees that the model update received by the server is bit-for-bit identical to the update sent by the client. Any modification during transit—whether due to network errors or an active man-in-the-middle attack—immediately invalidates the signature.

• Uses a cryptographic hash of the message as part of the signing process
• Even a single bit flip in the ciphertext causes signature verification to fail
• Protects against gradient manipulation attacks on the wire

This property is critical because a subtly altered gradient can skew the global model in a direction chosen by an adversary, undermining the integrity of the entire federated learning round.

Digital signatures provide non-repudiation, meaning a client cannot plausibly deny having submitted a specific model update. This creates an auditable trail essential for security forensics and regulatory compliance.

• If a malicious update is detected post-aggregation, the signature identifies the source
• Enables accountability mechanisms such as slashing or reputation penalties
• Critical for enterprise deployments subject to audit requirements

In Byzantine-robust aggregation, non-repudiation allows the system to retroactively exclude or penalize clients that submitted harmful updates, even if the attack was not detected in real-time.

Secure aggregation protocols typically employ specific digital signature algorithms optimized for the constraints of federated learning environments.

• Ed25519: A widely-used Edwards-curve signature scheme offering 128-bit security with small 64-byte signatures and fast verification, ideal for resource-constrained edge devices
• ECDSA: The Elliptic Curve Digital Signature Algorithm, standardized and broadly supported, though verification is slower than Ed25519
• BLS Signatures: Boneh-Lynn-Shacham signatures support efficient aggregate signatures, allowing the server to combine multiple client signatures into a single short signature, dramatically reducing verification overhead at scale

The choice of scheme balances signature size, verification speed, and the need for advanced properties like aggregation.

In a typical secure aggregation round, digital signatures are applied as a wrapper around the masked or encrypted update.

• Workflow: Client computes update → applies pairwise masks → encrypts → signs the ciphertext → transmits to server
• Server-side: Verifies signature → strips signature → passes ciphertext to aggregation protocol
• Ensures the semi-honest security guarantees of the aggregation protocol are not undermined by external adversaries on the network

Without signatures, an attacker could impersonate a legitimate client and submit carefully crafted updates designed to extract information about other clients' data through the aggregated result.

Classical digital signature schemes like ECDSA and Ed25519 are vulnerable to Shor's algorithm running on a sufficiently large quantum computer. For long-term security in federated learning systems, post-quantum signature schemes are being evaluated.

• CRYSTALS-Dilithium: A lattice-based signature scheme selected by NIST for standardization, offering security based on the hardness of Module-LWE and Module-SIS problems
• SPHINCS+: A stateless hash-based signature scheme providing conservative security but with larger signature sizes
• Migration requires upgrading the PKI and client libraries, but the aggregation protocol logic remains unchanged

Organizations handling highly sensitive data with long shelf-life should begin planning for hybrid classical/post-quantum signature deployments.