Paper deep dive
OPFL: Optimistic Verification of Federated Learning via Empirical Boundary
Hongxu Su, Jianzhu Yao, Xuechao Wang, Pramod Viswanath
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving $0$\% ASR against model poisoning and PGD-based attacks. On a LeNet workload, at $p=0.01$, OPFL is approximately $98.6\times$ faster than full MPC-based FL and $625.5\times$ faster than ZK-based approach.
Tags
Links
- Source: https://arxiv.org/abs/2609.37011v1
- Canonical: https://arxiv.org/abs/2609.37011v1
Trouble viewing inline? Open PDF directly →
Full Text
56,548 characters extracted from source content.
Expand or collapse full text
OPFL: Optimistic Verification of Federated Learning via Empirical Boundary Hongxu Su Email: hsu238@connect.hkust-gz.edu.cn Jianzhu Yao Email: jy0246@princeton.edu Xuechao Wang Email: xuechaowang@hkust-gz.edu.cn Pramod Viswanath Email: pramodv@princeton.edu Abstract Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving 00% ASR against model poisoning and PGD-based attacks. On a LeNet workload, at p=0.01p=0.01, OPFL is approximately 98.6×98.6× faster than full MPC-based FL and 625.5×625.5× faster than ZK-based approach. 1 Introduction Federated learning (FL) has become an important paradigm for collaborative machine learning in privacy-sensitive settings, including on-device learning and multi-institutional healthcare (McMahan et al., 2017; Molaei et al., 2024). Instead of collecting raw data at a central server, FL allows multiple clients to train a global model using their local datasets. In each round, clients download the current global model, perform local training, and return only model updates to the server for aggregation (McMahan et al., 2017). The raw training data therefore remains on client devices. However, this privacy benefit also makes local training difficult to observe. A malicious client may deviate from the prescribed training procedure or directly construct a poisoned update while still submitting it as the result of legitimate local training (Bagdasaryan et al., 2020; Zhuang et al., 2024; Pang et al., 2025). This creates an execution integrity problem: how can a server verify that a private client update was actually produced by the prescribed local training procedure? Existing approaches address this problem from several directions. Secure aggregation with update validation can constrain which client updates are accepted without revealing them (Lycklama et al., 2023; Roy Chowdhury et al., 2022; Bell et al., 2023; Zhu et al., 2024). However, these methods primarily verify properties or constraints of the submitted update rather than directly establishing how the update was produced. Cryptographic approaches can verify training computations more directly. For example, recent systems use zero-knowledge proofs to enforce private computation integrity in federated or split learning settings (Zhu et al., 2024; Zheng et al., 2026). Nevertheless, encoding deep neural-network training into cryptographic proofs remains expensive and difficult to scale (Zhu et al., 2024; Zheng et al., 2026). Replay provides another natural alternative. Prior approaches to verifiable training record intermediate training states and re-execute selected computations to check consistency with the claimed training trajectory (Jia et al., 2021; Srivastava et al., 2024). Yet replay is difficult to apply directly in federated learning. A verifier would need to reproduce the client’s execution environment as closely as possible and access the raw training data used in local computation, which conflicts with the privacy goal of federated learning. A natural alternative is to perform replay inside a cryptographically protected environment such as MPC. However, such environments differ from native GPU execution and can introduce unavoidable numerical discrepancies (Goldberg, 1991; Demmel and Nguyen, 2015; Collange et al., 2015; Srivastava et al., 2024). Their outputs cannot generally be compared through exact equality, making direct verification ineffective. To address these challenges, we introduce OPFL, a framework for privately verifying FL through an empirical gradient-discrepancy boundary. OPFL uses MPC to enable privacy-preserving replay, but does not require the replayed gradient to be bitwise identical to the gradient produced by native GPU training. Our key observation is that the gradient differences between GPU execution and MPC replay exhibit highly structured behavior and remain empirically bounded. This structured behavior gives rise to an empirical boundary that separates benign numerical discrepancies from malicious deviations. OPFL calibrates this boundary by executing the same training configuration in both native GPU and MPC environments and measuring the absolute gradient discrepancy |GGPU−GMPC| G_GPU-G_MPC in limited training steps. The resulting discrepancy distribution is summarized using a subset of percentile statistics, which preserves distributional information while avoiding the cost of checking every gradient coordinate. This calibration is performed offline once before FL starts and is reused during subsequent verification. Replaying every training step inside MPC is computationally expensive (Mohassel and Rindal, 2018; Ma et al., 2023). To reduce this cost, OPFL adopts an optimistic auditing mechanism and invokes MPC replay only on sampled training steps. This design follows a well-established paradigm in optimistic verification systems (Kalodner et al., 2018). Claims are accepted optimistically, while detected misbehavior can trigger challenges and economic penalties. Clients commit their training evidence before audit sampling. A verifier committee then replays only the selected steps inside MPC and checks the resulting gradient against the calibrated boundary. Failed audits trigger deposit slashing, under the assumption that a majority of committee members are honest. We evaluate OPFL across diverse training settings, including CNN and Transformer architectures, multiple optimizers, and both full model training and LoRA finetuning (Hu et al., 2022). First, we evaluate whether OPFL can distinguish honest numerical discrepancies from malicious deviations. We consider four representative attacks adapted from prior work, including gradient reuse, gradient sign reversal, label flipping, and gradient scaling (Fraboni et al., 2021; Damaskinos et al., 2018; Fang et al., 2020; Bagdasaryan et al., 2020; Lycklama et al., 2023). OPFL achieves 0% ASR while maintaining 0% false rejection rate across these attacks. We further construct a white-box adaptive PGD attack. PGD is widely regarded as a strong first-order adversary (Madry et al., 2018), making it a suitable stress test for our verification framework. The ASR remains 0% for OPFL. In contrast, the evaluated baselines can detect large deviations but are more easily bypassed under smaller adaptive perturbations. Detailed results are provided in section 4. Second, we study the stability and generalization of the calibrated boundary. As shown in section 4.2, a stable boundary can be obtained from only a small number of calibration steps. Across LeNet, BERT, and Qwen3, boundaries calibrated using the first 100 training steps generalize across different training stages, datasets, sequence lengths, and GPU hardware. Finally, we evaluate the system overhead of OPFL. In our five-client LeNet workload, a 1% audit rate reduces the measured verification and aggregation time by approximately 98.6×98.6× relative to full MPC-based verification and 625.5×625.5× relative to ZKSL-LP-G (Zheng et al., 2026). In summary, our key finding is that the gradient discrepancy between MPC execution and native GPU execution is bounded, and can therefore serve as an effective signal for identifying malicious training deviations, as demonstrated by our experiments. We further build a verification framework that audits FL clients without exposing their private training data, and introduce an optimistic verification mechanism to reduce system overhead. OPFL focuses on execution integrity and does not address data poisoning, which can be handled by complementary robust aggregation or trust-based defenses (Blanchard et al., 2017; Cao et al., 2021). The construction and incentivization of the verifier committee are also orthogonal to our design and can rely on established decentralized committee-selection and incentive mechanisms (Gilad et al., 2017; Kiayias et al., 2017). Finally, OPFL assumes an existing privacy-preserving aggregation layer, such as secure aggregation (Bonawitz et al., 2017), rather than introducing a new aggregation protocol. 2 Problem Formulation and Threat Model Motivation. FL assumes that participating clients faithfully execute the prescribed local training procedure before submitting their updates. In practice, a malicious or economically motivated client may deviate from this procedure. For example, it may skip computation, reuse a stale gradient, or directly fabricate an update to reduce local training cost. A client may also manipulate its computation to steer the global model toward a malicious objective (Fraboni et al., 2021; Bagdasaryan et al., 2020). Since the server observes only the submitted update, such deviations are difficult to distinguish from honestly generated updates without additional verification. FL Setting. We consider a FedSGD-style FL setting (McMahan et al., 2017) with a central server S and a set of clients ii=1n\C_i\_i=1^n. Each client iC_i holds a private local dataset DiD_i. At training round t, the server distributes the current global model WtW_t to the selected clients. Let zi,tz_i,t denote the private training input used by client iC_i at round t, derived from DiD_i. In this setting, each selected client performs a single local training step per round and submits the resulting gradient for aggregation. We use this formulation for clarity; the same verification principle can be extended to multi-step local training by treating each local step as an auditable computation and binding the corresponding intermediate states. Each selected client performs the prescribed local computation according to a public training configuration Π , which specifies the training algorithm, hyperparameters, model and optimizer settings, data-processing rules, randomness configuration, and other metadata required for replay. Client iC_i computes Gi,tGPU=TrainGPU(Wt,zi,t,Π),G_i,t^GPU=Train_GPU (W_t,z_i,t; ), (1) and submits the resulting gradient for aggregation. We augment this setting with a verifier committee K that audits randomly selected client-round pairs (i,t)(i,t). Before audit selection, each client commits to its private training inputs and claimed gradients. The global model WtW_t and training configuration Π are fixed independently of the client. We assume a public and binding commitment layer that prevents committed evidence from being modified. Our goal is not to determine whether a client’s private dataset is itself benign. Instead, we verify whether the committed gradient is consistent with executing the prescribed local computation on the committed private input. Verification Goal. A direct way to verify a client gradient is to replay the same computation and compare the result with the client’s claim. However, revealing zi,tz_i,t to the verifier would violate the privacy objective of FL. We therefore perform replay inside secure multi-party computation (MPC) (Mohassel and Rindal, 2018; Ma et al., 2023). For an audited client-round pair (i,t)(i,t), the committee obtains Gi,tMPC=TrainMPC(Wt,zi,t,Π)G_i,t^MPC=Train_MPC (W_t,z_i,t; ) (2) without revealing zi,tz_i,t to the committee members. Exact replay would require Gi,tGPU=Gi,tMPCG_i,t^GPU=G_i,t^MPC. In practice, this requirement is too strong. Native GPU execution and MPC replay use different numerical representations and computation environments, and can therefore produce different gradients even when both executions are honest (Srivastava et al., 2024). We therefore verify the discrepancy between the two gradients rather than requiring exact equality. For gradient coordinate j, the absolute discrepancy is Δi,t,jabs=|[Gi,tGPU]j−[Gi,tMPC]j|. _i,t,j^abs= | [G_i,t^GPU ]_j- [G_i,t^MPC ]_j |. (3) Let ℬB denote the empirical gradient-discrepancy boundary calibrated from honest GPU–MPC executions. An audited client-round pair is accepted if its discrepancy profile satisfies the thresholds specified by ℬB, and rejected otherwise. Section 3 defines the complete absolute and relative discrepancy profiles and describes how ℬB is calibrated. Accordingly, OPFL targets two properties. First, privacy: verification should not reveal the client’s raw training input to the verifier committee. Second, execution integrity: an audited deviation that produces discrepancies beyond the calibrated numerical tolerance should be rejected. Threat Model and Assumptions. We consider malicious clients that may arbitrarily deviate from the prescribed local computation by skipping computation, reusing previous gradients, modifying intermediate computation, or submitting arbitrary gradients. The adversary knows the verification procedure and boundary ℬB and may adapt its strategy accordingly. We assume: • Post-commitment auditing. Client evidence is committed before audit randomness is revealed, while WtW_t, Π , and ℬB are fixed independently of the client. • Binding commitments. Committed inputs and gradients cannot be replaced without detection. • MPC security. Committee members follow the MPC protocol, and corrupted members remain within its privacy threshold, preserving input confidentiality and correct verification. Scope. OPFL focuses on verifying the integrity of local training execution. It does not prevent data poisoning when a client faithfully executes the prescribed computation on malicious or poisoned local data; such threats can be addressed by complementary robust aggregation or trust-based defenses (Blanchard et al., 2017; Cao et al., 2021). We also do not address the construction of the verifier committee, which can rely on established decentralized committee-selection mechanisms (Gilad et al., 2017; Kiayias et al., 2017). Finally, OPFL assumes an existing privacy-preserving aggregation mechanism, such as secure aggregation (Bonawitz et al., 2017), rather than introducing a new aggregation protocol. These components are orthogonal to our work. 3 OPFL Design OPFL operates in three stages: preparation and commitment, local training, and pre-aggregation verification. The first stage fixes the verification rule and training configuration before execution. The second stage commits the client gradients produced during FL and sends them privately to the verifier committee. The third stage verifies every gradient against its commitment and performs MPC replay on randomly sampled client-round pairs before eligible contributions are released for aggregation. Figure 1 provides an overview of the workflow. Figure 1: Overview of the OPFL protocol. Preparation and commitment. OPFL relies on a public and binding commitment layer to record deposits and protocol commitments. A natural instantiation is a blockchain, which provides an immutable record and supports programmable deposit-and-slashing rules. Each client locks a predefined deposit on the blockchain. Before FL begins, the verifier performs offline calibration using a set of honest calibration steps. Let s index a calibration step and j a gradient coordinate. We define the absolute and relative discrepancies as Δs,jabs=|[GsGPU]j−[GsMPC]j|,Δs,jrel=Δs,jabsmax|[GsGPU]j|,|[GsMPC]j|+ϵ. _s,j^abs= |[G_s^GPU]_j-[G_s^MPC]_j |, _s,j^rel= _s,j^abs \|[G_s^GPU]_j|,|[G_s^MPC]_j|\+ε. (4) Here, ϵ>0ε>0 prevents division by zero and stabilizes the relative discrepancy near zero. For each calibration step s, the verifier treats Δs,jabsj=1d\ _s,j^abs\_j=1^d and Δs,jrelj=1d\ _s,j^rel\_j=1^d as empirical discrepancy distributions over the d gradient coordinates. Let Qsabs(p)Q_s^abs(p) and Qsrel(p)Q_s^rel(p) denote their empirical p-quantiles. We evaluate these quantiles on =0.02,0.05,0.10,0.15,…,0.90,0.95,0.98P=\0.02,0.05,0.10,0.15,…,0.90,0.95,0.98\. The grid P can be adjusted to trade verification granularity for cost. A denser grid captures more distributional information and stricter but requires more quantile computation and boundary checks. Percentile profiles characterize the overall discrepancy distribution but leave extreme tail coordinates unconstrained. We therefore additionally define Δs∞=‖GsGPU−GsMPC‖∞ _s^∞=\|G_s^GPU-G_s^MPC\|_∞. Let calS_cal denote the set of calibration steps. The raw bounds are B~pabs=maxs∈calQsabs(p),B~prel=maxs∈calQsrel(p),B~∞=maxs∈calΔs∞. B_p^abs= _s _calQ_s^abs(p), B_p^rel= _s _calQ_s^rel(p), B_∞= _s _cal _s^∞. (5) To provide additional tolerance for deployment-time numerical variation, the raw bounds are enlarged by a predefined safety factors αabs,αrel,α∞∈ℝ>0 _abs, _rel, _∞ _>0: Bpabs=αabsB~pabs,Bprel=αrelB~prel,B∞=α∞B~∞.B_p^abs= _abs B_p^abs, B_p^rel= _rel B_p^rel, B_∞= _∞ B_∞. (6) The deployed verification boundary is ℬ=(Bpabs,Bprelp∈,B∞)B= (\B_p^abs,B_p^rel\_p ,B_∞ ). Boundary calibration is performed only once for a given model and the resulting boundary is fixed before FL begins. The client then commits to the private training inputs used during training. Let D~i=(zi,0,…,zi,Ni−1) D_i=(z_i,0,…,z_i,N_i-1) denote the canonicalized sequence of training inputs of client iC_i. For each input, the client samples private randomness ri,tr_i,t. The input commitment and dataset root are ci,t=H(D‖ri,t‖Encode(zi,t)),cDi=(ci,0,…,ci,Ni−1),c_i,t=H\! ( tag_D\|r_i,t\|Encode(z_i,t) ), c_D_i= MerkleRoot(c_i,0,…,c_i,N_i-1), (7) where Encode(⋅)Encode(·) denotes a deterministic canonical encoding. The dataset commitment cDic_D_i, calibrated boundary ℬB, and training policy Π are fixed and publicly recorded on the commitment layer before training, while the underlying dataset remains private. Local training and gradient commitment. At round t, client iC_i uses the global model WtW_t, the committed training batch zi,tz_i,t, and public policy Π to compute Gi,tGPU=TrainGPU(Wt,zi,t,Π)G_i,t^GPU=Train_GPU(W_t,z_i,t; ). The client samples private randomness rGi,tr_G_i,t and publishes the gradient commitment cGi,t=H(G‖rGi,t‖Encode(Gi,tGPU))c_G_i,t=H( tag_G\|r_G_i,t\|Encode(G_i,t^GPU)) before audit selection. Instead of sending the gradient directly to the aggregation server, the client secret-shares Gi,tGPUG_i,t^GPU and rGi,tr_G_i,t to the verifier committee for pre-aggregation verification. Pre-aggregation verification and auditing. Verification proceeds in two gates before aggregation. First, every submitted gradient is checked inside MPC against its previously published commitment. For client-round pair (i,t)(i,t), the committee verifies bG,i,t=[H(G∥rGi,t∥Encode(Gi,tGPU))=cGi,t].b_G,i,t= [H\! ( tag_G\|r_G_i,t\|Encode(G_i,t^GPU) )=c_G_i,t ]. (8) A contribution that fails this commitment check is rejected and never enters aggregation. Second, after gradient commitments are fixed, the protocol randomly samples client-round pairs for replay auditing. An unaudited contribution that passes the commitment check is accepted optimistically. For an audited pair (i,t)(i,t), the client additionally secret-shares the committed training input zi,tz_i,t and its opening ri,tr_i,t. The committee verifies that the input belongs to the committed dataset and then replays the prescribed computation inside MPC: Gi,tMPC=TrainMPC(Wt,zi,t,Π)G_i,t^MPC=Train_MPC(W_t,z_i,t; ). The committee computes the absolute and relative discrepancy profiles between Gi,tGPUG_i,t^GPU and Gi,tMPCG_i,t^MPC. Let Pi,tabs(p)P_i,t^abs(p) and Pi,trel(p)P_i,t^rel(p) denote the corresponding empirical p-quantiles. It also computes the tail discrepancy Δi,t∞=‖Gi,tGPU−Gi,tMPC‖∞ _i,t^∞=\|G_i,t^GPU-G_i,t^MPC\|_∞. The replay audit passes only if Pi,tabs(p)≤Bpabs,Pi,trel(p)≤Bprel,∀p∈;Δi,t∞≤B∞.P_i,t^abs(p)≤ B_p^abs, P_i,t^rel(p)≤ B_p^rel, ∀ p ; _i,t^∞≤ B_∞. (9) Only contributions that pass the commitment gate and, when sampled, the replay audit are authorized for aggregation. The committee forwards the same verified gradient shares to the aggregation layer, so the client does not provide a second aggregation input. Contributions that fail either gate are excluded from aggregation and trigger the predefined penalty. Only the final eligibility decision is revealed. Let ai,t∈0,1a_i,t∈\0,1\ denote the post-commitment audit indicator, where ai,t=1a_i,t=1 indicates that (i,t)(i,t) is selected for replay. Algorithm 1 summarizes the procedure. Algorithm 1 Pre-aggregation verification in OPFL 1: Wt,Π,ℬ,cDi,cGi,t,ci,t,ai,tW_t, ,B,c_D_i,c_G_i,t,c_i,t,a_i,t 2: Private [Gi,tGPU],[rGi,t][G_i,t^GPU],[r_G_i,t] 3: If ai,t=1a_i,t=1: private [zi,t],[ri,t][z_i,t],[r_i,t]; public Merkle path πi,t _i,t 4: yi,t∈,y_i,t∈\ PASS, FAIL\ 5: [bG]←[H(G∥[rGi,t]∥Encode([Gi,tGPU]))=cGi,t][b_G]←[H( tag_G\|[r_G_i,t]\|Encode([G_i,t^GPU]))=c_G_i,t] 6: if ai,t=1a_i,t=1 then 7: [bD]←[H(D∥[ri,t]∥Encode([zi,t]))=ci,t]∧(ci,t,πi,t,cDi)[b_D]←[H( tag_D\|[r_i,t]\|Encode([z_i,t]))=c_i,t] MerkleVerify(c_i,t, _i,t,c_D_i) 8: [Gi,tMPC]←TrainMPC(Wt,[zi,t],Π)[G_i,t^MPC] _MPC(W_t,[z_i,t]; ) 9: [Pi,tabs],[Pi,trel],[Δi,t∞]←([Gi,tGPU],[Gi,tMPC])[P_i,t^abs],[P_i,t^rel],[ _i,t^∞]← DiscrepancyProfile([G_i,t^GPU],[G_i,t^MPC]) 10: [bℬ]←⋀p∈([Pi,tabs(p)≤Bpabs]∧[Pi,trel(p)≤Bprel])∧[Δi,t∞≤B∞][b_B]← _p ([P_i,t^abs(p)≤ B_p^abs] [P_i,t^rel(p)≤ B_p^rel] ) [ _i,t^∞≤ B_∞] 11: [yi,t]←[bG]∧[bD]∧[bℬ][y_i,t]←[b_G] [b_D] [b_B] 12: else 13: [yi,t]←[bG][y_i,t]←[b_G] 14: end if 15: yi,t←([yi,t])y_i,t← Open([y_i,t]) 16: return yi,ty_i,t 4 Experimental Evaluation We evaluate OPFL on three representative models with different scales and training settings, as summarized in Table 1. Our evaluation covers both CNN and Transformer architectures, multiple optimizers, and both full model training and LoRA finetuning. The attack experiments evaluate the verification rule of OPFL independently of audit sampling and assume that all tested instances are audited. System-level security further relies on optimistic auditing with deposit-and-slashing incentives. Table 1: Models and training configurations used in our evaluation. Model #Parameters Training Optimizer Datasets LeNet 431K Full training Momentum SGD MNIST, Fashion-MNIST BERT-Base 110M LoRA, last two layers AdamW SST-2, CoLA Qwen3 0.6B LoRA, last two layers SGD Alpaca, Dolly Our evaluation focuses on three questions. First, because the empirical boundary is the central verification criterion in OPFL, we study its stability and generalization. In particular, we examine whether a reliable boundary can be calibrated from only a small number of training steps and subsequently generalized across different training conditions, reducing the cost of the calibration stage. Second, we evaluate the effectiveness of OPFL against malicious training deviations. We consider gradient reuse, gradient sign reversal, label flipping, gradient scaling, and an adaptive PGD-based attack designed to evade the calibrated boundary. We further compare OPFL with RoFL-L2L_2, RoFL-L∞L_∞, EIFFeL, and RiseFL by evaluating whether each method can reject the same adaptive malicious updates under its respective verification rule. Finally, we evaluate the system overhead of OPFL and compare its cost with full MPC-based FL and ZK-based verification. Experimental setup. We implement OPFL in PyTorch with Secure Processing Unit (SPU) (Ma et al., 2023) as the MPC backend under a three-party semi-honest setting. Experiments use four NVIDIA RTX 4090 GPUs and two Intel Xeon Platinum 8336C CPUs at 2.30 GHz, while cross-device generalization is evaluated on an additional RTX A4500 server. 4.1 Effectiveness against model poisoning General attacks. We first evaluate whether OPFL can reject malicious updates while still accepting honest computation. Reporting ASR alone is insufficient, since a verifier that rejects every update would trivially achieve 0% ASR. We therefore report both ASR and false rejection rate (FRR). ASR is the fraction of attacked steps that both evade verification and achieve their intended malicious effect, while FRR is the fraction of unattacked honest steps that are incorrectly rejected: FRR=# rejected honest steps# honest verification steps.FRR= \# rejected honest steps\# honest verification steps. (10) We consider four representative attack patterns adapted from prior work on free-riding, Byzantine gradient manipulation, data poisoning, and model-replacement attacks in federated and distributed learning (Fraboni et al., 2021; Damaskinos et al., 2018; Fang et al., 2020; Bagdasaryan et al., 2020; Lycklama et al., 2023). For each model, we evaluate 2,000 training steps and randomly select 20% of them for attack. Let Gi,tGPUG_i,t^GPU denote the honest client gradient defined previously, and let G~i,t G_i,t denote the gradient submitted under attack. We consider: (i) Gradient Reuse, where the attacker computes a fresh honest gradient once every k steps and reuses the most recent gradient in the intermediate steps, with replay interval k∈2,5,10k∈\2,5,10\; (i) Reverse, where G~i,t=−γGi,tGPU G_i,t=-γ G_i,t^GPU with γ∈0.5,1,2γ∈\0.5,1,2\; (i) Label Flip, where the supervision target is replaced while keeping the model state and input unchanged, and the resulting gradient is submitted; and (iv) Amplify, where G~i,t=γGi,tGPU G_i,t=γ G_i,t^GPU with γ∈5,10γ∈\5,10\. We evaluate these attacks on LeNet, BERT-Base, and Qwen3-0.6B. As summarized in Table 2(a), OPFL achieves 0% ASR and 0% FRR across different settings. PGD-based adaptive attack. We further evaluate OPFL against a white-box adaptive attack that explicitly optimizes against the verification rule. For each evaluated step t, let Gi,tGPUG_i,t^GPU be the honest gradient. The attacker submits G~i,t=Gi,tGPU+δt,‖δt‖2=β‖Gi,tGPU‖2, G_i,t=G_i,t^GPU+ _t, \| _t\|_2=β\|G_i,t^GPU\|_2, (11) where β∈0.01,0.1,0.5,1,2,5,10β∈\0.01,0.1,0.5,1,2,5,10\ controls the attack strength. The attacker has access to the model state, optimizer state, and verification rule, and searches for a perturbation that changes a previously correct prediction while remaining acceptable to the verifier. Specifically, it maximizes the post-update prediction loss together with a soft penalty for violating the corresponding verification constraint. The final candidate must still pass the actual verification rule; the optimization penalty itself does not determine acceptance. We construct the attack separately for each verifier, so each method is evaluated against an adversary adapted to its own acceptance rule. We compare OPFL with RoFL-L2L_2 and RoFL-L∞L_∞ (Lycklama et al., 2023), EIFFeL-NormBall (Roy Chowdhury et al., 2022), and RiseFL-Gaussian (Zhu et al., 2024). These baselines are implemented as gradient-domain verification rules rather than full end-to-end reproductions of their cryptographic protocols. For OPFL, the attacker is optimized against the frozen deployed boundary and the same-step MPC reference Gi,tMPCG_i,t^MPC. Detailed verifier definitions and attack parameters are provided in Appendix B. We evaluate 200 instances per model for LeNet, BERT-Base, and Qwen3-0.6B, restricting evaluation to instances whose honest update produces the correct prediction. An attack succeeds only if the submitted gradient passes verification and changes that prediction from correct to incorrect. As summarized in Table 2(b), OPFL achieves 0% ASR for every model and attack strength. In contrast, the baseline rules remain vulnerable to adaptive perturbations. Full results for all values of β are reported in Appendix B. Together with the 0% FRR above, these results indicate that OPFL separates the evaluated malicious deviations from honest computation rather than simply applying an overly restrictive acceptance rule. We additionally evaluate tail-sparse PGD attacks on LeNet, restricting perturbations to the top 1% or 10% of coordinates ranked by absolute loss-gradient magnitude, with the same attack settings and strengths. The 1% setting uses the full percentile grid, whereas the 10% setting retains only checks at or below P90; both retain the infinity-norm guard. Without verification, ASR reaches 43.0% and 56.5%, respectively; with OPFL, it remains 0% at every tested strength (Appendix B). These results support robustness in the evaluated settings, but do not establish security for arbitrary percentile grids or support sets. Adding percentile checks while retaining existing thresholds can further constrain accepted discrepancies, at additional verification cost. Table 2: Summary of attack evaluation. (a) General-attack results across all evaluated models and settings. (b) Maximum ASR (%) over PGD attack strengths β∈0.01,0.1,0.5,1,2,5,10β∈\0.01,0.1,0.5,1,2,5,10\. (a) General attacks Attack Parameters ASR FRR Gradient Reuse k∈2,5,10k∈\2,5,10\ 0% 0% Reverse γ∈0.5,1,2γ∈\0.5,1,2\ 0% 0% Label Flip full replacement 0% 0% Amplify γ∈5,10γ∈\5,10\ 0% 0% (b) Adaptive PGD Verifier LeNet BERT Qwen3 No verifier 100.0 90.0 35.0 RoFL-L2L_2 90.5 33.5 7.0 RoFL-L∞L_∞ 99.5 37.5 32.0 EIFFeL 89.5 32.0 7.0 RiseFL 97.99 34.5 12.42 OPFL 0 0 0 4.2 Stability and generalization of the empirical boundary Finally, we study how many calibration steps are needed to obtain a stable boundary and whether the resulting boundary generalizes beyond the calibration setting. For BERT-Base, we calibrate on SST-2 with sequence length 32 and batch size 1 using the first n∈20,50,100,200,300,500n∈\20,50,100,200,300,500\ steps. Each resulting boundary is then frozen and evaluated without recalibration across held-out settings with different input sequence lengths, datasets, and GPUs. As shown in Table 2, small calibration sets can yield overly tight boundaries. With 20 steps, the FRR reaches 32.4% on SST-2/64 and 2.0% on the RTX A4500 setting; with 50 steps, SST-2/64 still has a 4.1% FRR. In contrast, 100 calibration steps achieve 0% FRR across all four evaluated settings, and increasing the calibration size to 200–500 steps provides no further improvement while increasing calibration cost. We therefore adopt 100 steps as the default calibration budget. Table 3: BERT-Base FRR versus calibration steps. Steps SST-2/32 SST-2/64 CoLA/32 A4500 Cost 20 2.33% 32.40% 0.10% 2.00% 0.2× 50 0% 4.10% 0% 0% 0.5× 100 0% 0% 0% 0% 1× 200 0% 0% 0% 0% 2× 300 0% 0% 0% 0% 3× 500 0% 0% 0% 0% 5× Figure 2: Generalization of the Qwen3 boundary. We observe the same trend for Qwen3 and LeNet: 100 calibration steps yield 0% FRR across all evaluated generalization settings. Figure 2 shows the generalization of Qwen3 absolute boundary and tail guard calibrated from 100 steps across different settings, with additional results in Appendix A. These results support the stability and generalization of the calibrated boundary. 4.3 System Overhead and Cost Amortization This section evaluates the computational cost of OPFL and the trade-off between audit rate and economic deterrence. Our goal is to quantify how optimistic auditing amortizes expensive private verification, rather than to provide a strict system-level comparison across different cryptographic backends. We construct a five-client FedSGD workload using LeNet with 0.0617M parameters, following the configuration evaluated in ZKSL (Zheng et al., 2026). Each client performs one local gradient step per round with batch size 1, and the server equally aggregates the five gradients. We consider 1,000 rounds, corresponding to 5,000 client gradient computations and 1,000 aggregations. We compare ZKSL-G, ZKSL-LP-G, full MPC-based FL, and OPFL with audit rates p∈0.10,0.05,0.01p∈\0.10,0.05,0.01\. ZKSL costs are extrapolated from the original work, while MPC costs are estimated from our SPU implementation. The reported time includes verification and aggregation but excludes initialization, communication, commitment, and one-time boundary calibration costs. Table 4: Verification cost and normalized deposit. K denotes 10310^3. Deposit ratios are normalized to OPFL with p=0.10p=0.10 and use pFR=0.01p_FR=0.01. Method Time (s) Time ratio Deposit Deposit ratio ZKSL-G 16.09K 8.38 0.00 0.00 ZKSL-LP-G 12.19K 6.35 0.00 0.00 Full MPC-based FL 1.92K 1.00 0.00 0.00 OPFL, p=0.10p=0.10 192.35 0.10 1.11 1.00 OPFL, p=0.05p=0.05 96.32 0.05 1.12 1.01 OPFL, p=0.01p=0.01 19.49 0.01 1.76 1.59 Table 4 shows that the cost of OPFL decreases nearly linearly with the audit rate. At p=0.01p=0.01, OPFL is approximately 98.6×98.6× faster than full MPC-based FL and 625.5×625.5× faster than ZKSL-LP-G under this workload. These results should be interpreted as a cost analysis rather than a strict end-to-end speedup because the measurements use different hardware environments. They illustrate that OPFL pays the cost of expensive private replay only for a small fraction of committed computations. Audit rate and deposit trade-off. A lower audit rate reduces verification cost but also decreases the probability of detecting deviations. Consider a client that skips 100 of its 1,000 rounds, with the saved computation normalized to one unit. If each round is independently audited with probability p, the probability of detecting at least one skipped computation is Prdet(p)=1−(1−p)100 _det(p)=1-(1-p)^100. Because the verification boundary is empirically calibrated, we conservatively allow an overall false-rejection probability pFR=0.01p_FR=0.01 for an honest client. Let (p) Stake(p) denote the refundable deposit. Relative to honest execution, the expected additional utility of deviation is ΔU(p)=1−(Prdet(p)−pFR)(p) U(p)=1-( _det(p)-p_FR) Stake(p). We use a 10% deterrence margin and set (p)=1.1/(Prdet(p)−pFR) Stake(p)=1.1/( _det(p)-p_FR), which gives ΔU(p)=−0.1 U(p)=-0.1. As shown in Table 4, reducing p from 0.100.10 to 0.050.05 has little effect on the required deposit, while p=0.01p=0.01 increases it to 1.59×1.59× the deposit required at p=0.10p=0.10. Deposit considerations. This analysis illustrates the trade-off between computational auditing and economic deterrence rather than prescribing a universal deposit value. Malicious behavior may provide benefits beyond saved computation and can be difficult to quantify. Deployed blockchain systems therefore often require nontrivial collateral and penalize provable misbehavior (Ethereum Foundation, ; Offchain Labs, ). For example, Ethereum validators are subject to stake slashing, while Arbitrum uses stake-backed claims and challenge penalties. A deployment of OPFL can therefore choose the deposit conservatively according to the expected attack benefit and measured reliability of the deployed boundary. 5 Conclusion We presented OPFL, an optimistic verification framework for privacy-preserving federated learning. OPFL combines private MPC replay with an empirical gradient-discrepancy boundary to verify sampled client computations without requiring bitwise agreement across execution environments. Our experiments show that the boundary remains stable across diverse training settings and detects the evaluated direct and adaptive attacks while maintaining a low FRR. By applying an optimistic verification mechanism, OPFL also substantially reduces verification cost. We believe this provides a practical direction for verifying federated learning while preserving data privacy. AI use statement We used generative AI tools to improve the clarity and readability of the manuscript, assist with literature searches, and support code development and debugging. The authors reviewed and revised the AI-assisted text, checked the cited sources for accuracy and relevance, and reviewed and tested the AI-assisted code. The authors take responsibility for the final manuscript, including all claims, references, code, and reported results. References Bagdasaryan et al. (2020) E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov How to backdoor federated learning. In Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, Vol. 108, p. 2938–2948. Cited by: §1, §1, §2, §4.1. Bell et al. (2023) J. Bell, A. Gascón, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun ACORN: input validation for secure aggregation. In 32nd USENIX Security Symposium (USENIX Security 23), p. 4805–4822. Cited by: §1. Blanchard et al. (2017) P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer Machine learning with adversaries: byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems, Vol. 30. Cited by: §1, §2. Bonawitz et al. (2017) K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, p. 1175–1191. External Links: Document Cited by: §1, §2. Cao et al. (2021) X. Cao, M. Fang, J. Liu, and N. Z. Gong FLTrust: byzantine-robust federated learning via trust bootstrapping. In Network and Distributed System Security Symposium (NDSS), External Links: Document Cited by: §1, §2. Collange et al. (2015) S. Collange, D. Defour, S. Graillat, and R. Iakymchuk Numerical reproducibility for the parallel reduction on multi- and many-core architectures. Parallel Computing 49, p. 83–97. External Links: Document Cited by: §1. Damaskinos et al. (2018) G. Damaskinos, E. El-Mhamdi, R. Guerraoui, R. Patra, and M. Taziki Asynchronous byzantine machine learning (the case of SGD). In Proceedings of the 35th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 80, p. 1145–1154. Cited by: §1, §4.1. Demmel and Nguyen (2015) J. Demmel and H. D. Nguyen Parallel reproducible summation. IEEE Transactions on Computers 64 (7), p. 2060–2070. External Links: Document Cited by: §1. [9] Ethereum Foundation Proof-of-stake rewards and penalties. Note: https://ethereum.org/developers/docs/consensus-mechanisms/pos/rewards-and-penalties/Accessed 2026 Cited by: §4.3. Fang et al. (2020) M. Fang, X. Cao, J. Jia, and N. Z. Gong Local model poisoning attacks to byzantine-robust federated learning. In 29th USENIX Security Symposium (USENIX Security 20), p. 1605–1622. Cited by: §1, §4.1. Fraboni et al. (2021) Y. Fraboni, R. Vidal, and M. Lorenzi Free-rider attacks on model aggregation in federated learning. In Proceedings of The 24th International Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, Vol. 130, p. 1846–1854. Cited by: §1, §2, §4.1. Gilad et al. (2017) Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich Algorand: scaling byzantine agreements for cryptocurrencies. In Proceedings of the 26th ACM Symposium on Operating Systems Principles, p. 51–68. External Links: Document Cited by: §1, §2. Goldberg (1991) D. Goldberg What every computer scientist should know about floating-point arithmetic. ACM Computing Surveys 23 (1), p. 5–48. External Links: Document Cited by: §1. Hu et al. (2022) E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen LoRA: low-rank adaptation of large language models. In International Conference on Learning Representations, Cited by: §1. Jia et al. (2021) H. Jia, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, A. Thudi, V. Chandrasekaran, and N. Papernot Proof-of-learning: definitions and practice. In 2021 IEEE Symposium on Security and Privacy (SP), p. 1039–1056. External Links: Document Cited by: §1. Kalodner et al. (2018) H. Kalodner, S. Goldfeder, X. Chen, S. M. Weinberg, and E. W. Felten Arbitrum: scalable, private smart contracts. In 27th USENIX Security Symposium (USENIX Security 18), p. 1353–1370. Cited by: §1. Kiayias et al. (2017) A. Kiayias, A. Russell, B. David, and R. Oliynykov Ouroboros: a provably secure proof-of-stake blockchain protocol. In Advances in Cryptology – CRYPTO 2017, Lecture Notes in Computer Science, Vol. 10401, p. 357–388. External Links: Document Cited by: §1, §2. Lycklama et al. (2023) H. Lycklama, L. Burkhalter, A. Viand, N. Küchler, and A. Hithnawi RoFL: robustness of secure federated learning. In 2023 IEEE Symposium on Security and Privacy (SP), p. 453–476. External Links: Document Cited by: §1, §1, §4.1, §4.1. Ma et al. (2023) J. Ma, Y. Zheng, J. Feng, D. Zhao, H. Wu, W. Fang, J. Tan, C. Yu, B. Zhang, and L. Wang SecretFlow-SPU: a performant and User-Friendly framework for Privacy-Preserving machine learning. In 2023 USENIX Annual Technical Conference (USENIX ATC 23), p. 17–33. Cited by: §1, §2, §4. Madry et al. (2018) A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, Cited by: §1. McMahan et al. (2017) B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Agüera y Arcas Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, Vol. 54, p. 1273–1282. Cited by: §1, §2. Mohassel and Rindal (2018) P. Mohassel and P. Rindal ABY3: a mixed protocol framework for machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, p. 35–52. External Links: Document Cited by: §1, §2. Molaei et al. (2024) S. Molaei, A. Thakur, G. Niknam, A. Soltan, H. Zare, and D. A. Clifton Federated learning for heterogeneous electronic health records utilising augmented temporal graph attention networks. In Proceedings of the 27th International Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, Vol. 238, p. 1342–1350. Cited by: §1. [24] Offchain Labs Arbitrum nitro: a second-generation optimistic rollup. Note: https://docs.arbitrum.io/nitro-whitepaper.pdfAccessed 2026 Cited by: §4.3. Pang et al. (2025) X. Pang, C. Zhao, Z. Wang, J. Hu, Y. Wang, L. Wang, T. Wei, K. Ren, and C. Chen PoiSAFL: scalable poisoning attack framework to byzantine-resilient semi-asynchronous federated learning. In 34th USENIX Security Symposium (USENIX Security 25), p. 6461–6479. Cited by: §1. Roy Chowdhury et al. (2022) A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten EIFFeL: ensuring integrity for federated learning. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, p. 2535–2549. External Links: Document Cited by: §1, §4.1. Srivastava et al. (2024) M. Srivastava, S. Arora, and D. Boneh Optimistic verifiable training by controlling hardware nondeterminism. In Advances in Neural Information Processing Systems, Vol. 37, p. 95639–95661. External Links: Document Cited by: §1, §2. Zheng et al. (2026) Y. Zheng, C. Wei, X. Qi, H. Wu, Y. Wu, L. Lin, T. Song, Y. Yan, Y. Yang, Z. Zhang, C. Jin, and A. Zhou ZKSL: verifiable and efficient split federated learning via asynchronous zero-knowledge proofs. In Network and Distributed System Security Symposium (NDSS), External Links: Document Cited by: §1, §1, §4.3. Zhu et al. (2024) Y. Zhu, Y. Wu, Z. Luo, B. C. Ooi, and X. Xiao Secure and verifiable data collaboration with low-cost zero-knowledge proofs. Proceedings of the VLDB Endowment 17 (9), p. 2321–2334. External Links: Document Cited by: §1, §4.1. Zhuang et al. (2024) H. Zhuang, M. Yu, H. Wang, Y. Hua, J. Li, and X. Yuan Backdoor federated learning by poisoning backdoor-critical layers. In International Conference on Learning Representations, Cited by: §1. Appendix A Additional Boundary Generalization Results Figure 3 complements Figure 2 by providing a visual comparison of the boundary and gradient differences for all three models: Qwen3, LeNet, and BERT-Base. The deployed boundary is calibrated using the first 100 training steps and is then frozen for evaluation. We use a safety factor of α=4α=4 for Qwen3 and α=3α=3 for LeNet. Across all evaluated generalization settings, the resulting boundaries achieve 0% FRR, consistent with the trend observed for BERT-Base. (a) Qwen3: absolute (b) BERT: absolute (c) LeNet: absolute (d) Qwen3: relative (e) BERT: relative (f) LeNet: relative Figure 3: Generalization of the deployed boundaries calibrated from 100 steps for Qwen3, BERT, and LeNet. The top and bottom rows show absolute and relative gradient discrepancies, respectively. Solid lines and shaded regions show the median and percentile range across evaluation steps, respectively; dashed lines indicate the deployed boundaries. Appendix B Adaptive PGD Attack Details Attack construction. We evaluate a white-box adaptive PGD attack against each verification rule. For an evaluated client-step pair (i,t)(i,t), let Gi,tGPUG_i,t^GPU denote the honest gradient. The attacker submits G~i,t=Gi,tGPU+δt,‖δt‖2=β‖Gi,tGPU‖2, G_i,t=G_i,t^GPU+ _t, \| _t\|_2=β\|G_i,t^GPU\|_2, (12) where β∈0.01,0.1,0.5,1,2,5,10.β∈\0.01,0.1,0.5,1,2,5,10\. Let Ut(G)U_t(G) denote the model parameters obtained by applying gradient G from the saved model parameters and optimizer state at step t. The attacker searches for a perturbation that maximizes the post-update prediction loss while remaining compatible with the target verifier: max‖δ‖2=β‖Gi,tGPU‖2ℓ(fUt(Gi,tGPU+δ)(xt),yt)−λV(Gi,tGPU+δ), _\|δ\|_2=β\|G_i,t^GPU\|_2 \! (f_U_t(G_i,t^GPU+δ)(x_t),y_t )- _V (G_i,t^GPU+δ ), (13) where VP_V is a differentiable penalty associated with verifier V and λ=100λ=100. We optimize each verifier separately rather than generating a single unconstrained attack and evaluating it against all methods. Optimization uses normalized gradient ascent for 20 iterations. After each iteration, the perturbation is projected back to the fixed-radius sphere. The step size is set to one fifth of the perturbation radius. Each attack uses three initializations: one aligned with the prediction-loss gradient and two random directions. We use random seed 42. Importantly, the soft penalty is used only to guide optimization; the final candidate must still pass the actual verification rule. We evaluate 200 instances for each model. All selected instances are required to produce a correct prediction after the honest update. For LeNet and BERT, an attack succeeds when the post-update class prediction changes from correct to incorrect. For Qwen3, we evaluate the final supervised token position and require the originally correct token prediction to become incorrect. Thus, the attack objective is an untargeted prediction flip. Verification baselines. We compare OPFL against gradient-domain adaptations of RoFL-L2L_2, RoFL-L∞L_∞, EIFFeL-NormBall, and RiseFL-Gaussian, together with a no-verification baseline. These experiments compare the corresponding gradient acceptance rules rather than reproducing the complete end-to-end cryptographic protocols. Using the first 100 honest training steps, we define B2=maxt<100‖Gi,tGPU‖2,B∞RoFL=maxt<100‖Gi,tGPU‖∞,B_2= _t<100 \|G_i,t^GPU \|_2, B_∞^RoFL= _t<100 \|G_i,t^GPU \|_∞, (14) and R=maxt<100‖Gi,tGPU−Vt‖2,R= _t<100 \|G_i,t^GPU-V_t \|_2, (15) where VtV_t is a reference gradient computed from a fixed public reference dataset at the saved model state. Table 5: Verification rules used in the adaptive PGD evaluation. Verifier Acceptance rule No verifier Always accept RoFL-L2L_2 ‖G~i,t‖2≤B2\| G_i,t\|_2≤ B_2 RoFL-L∞L_∞ ‖G~i,t‖∞≤B∞RoFL\| G_i,t\|_∞≤ B_∞^RoFL EIFFeL-NormBall ‖G~i,t−Vt‖2≤R\| G_i,t-V_t\|_2≤ R RiseFL-Gaussian Gaussian projection norm test OPFL Pi,tabs(p)≤BpabsP_i,t^abs(p)≤ B_p^abs and Pi,trel(p)≤BprelP_i,t^rel(p)≤ B_p^rel, ∀p∈∀ p and Δi,t∞≤B∞ _i,t^∞≤ B_∞ The corresponding acceptance rules are summarized in Table 5. All constraints are applied to the submitted gradient G~i,t G_i,t rather than to the perturbation δt _t. For the deterministic norm-based baselines, the adaptive penalty is defined as V(u)=[max(cV(u)bV−1,0)]2,P_V(u)= [ ( c_V(u)b_V-1,0 ) ]^2, (16) where cV(u)c_V(u) denotes the corresponding norm statistic and bVb_V its threshold. For RiseFL-Gaussian, we use K=1000K=1000 Gaussian projections and ϵ=2−128ε=2^-128. For a fixed submitted gradient u, the quantile q, the analytical acceptance probability pacc(u)p_acc(u) of u, and the penalty V(u)P_V(u) used in the adaptive objective are defined as q q =FχK2−1(1−ϵ), =F_χ^2_K^-1(1-ε), (17) pacc(u) p_acc(u) =FχK2(qB22‖u‖22), =F_χ^2_K ( qB_2^2\|u\|_2^2 ), V(u) _V(u) =(1−pacc(u))2. = (1-p_acc(u) )^2. After optimization, the selected candidate is evaluated using an independent randomized audit. For OPFL, the submitted gradient is compared with the same-step MPC replay Gi,tMPCG_i,t^MPC. The deployed empirical boundary is frozen before the attack and is not recalibrated using adversarial samples. We use safety factors (αabs,αrel,α∞)=(3,3,3)( _abs, _rel, _∞)=(3,3,3) for LeNet, (3,3,6)(3,3,6) for BERT, and (4,4,4)(4,4,4) for Qwen3. Attack success rate. An attack is considered successful only if it both passes verification and changes an originally correct prediction to an incorrect one. For N=200N=200 evaluated instances, we report ASR=1N∑n=1N[prediction flip]pacc(G~i,t(n)).ASR= 1N _n=1^N1 [prediction flip ]\,p_acc ( G_i,t^(n) ). (18) For deterministic verifiers, pacc∈0,1p_acc∈\0,1\. For RiseFL, we report the expected ASR weighted by its analytical acceptance probability. If optimization fails to find an acceptable malicious candidate and falls back to the honest gradient, the instance is counted as an attack failure and remains in the denominator. Full results. Tables 6, 7, and 8 report the complete results for all tested attack strengths. Table 6: Adaptive PGD attack success rate (%) on LeNet. β None RoFL-L2L_2 RoFL-L∞L_∞ EIFFeL RiseFL OPFL 0.01 0.0 0.0 0.0 0.0 0.0 0.0 0.1 4.5 4.5 4.5 4.5 4.5 0.0 0.5 29.5 29.5 29.5 29.5 29.5 0.0 1 57.0 57.0 57.0 57.0 57.0 0.0 2 90.0 90.0 90.0 89.5 90.0 0.0 5 99.0 90.5 99.0 68.0 97.99 0.0 10 100.0 37.0 99.5 13.0 71.48 0.0 Table 7: Adaptive PGD attack success rate (%) on BERT-Base. β None RoFL-L2L_2 RoFL-L∞L_∞ EIFFeL RiseFL OPFL 0.01 0.0 0.0 0.0 0.0 0.0 0.0 0.1 4.5 4.5 4.5 4.5 4.5 0.0 0.5 20.0 20.0 20.0 20.0 20.0 0.0 1 35.5 33.5 35.0 32.0 34.5 0.0 2 49.5 33.5 37.5 27.0 21.0 0.0 5 72.0 0.0 14.0 0.0 0.0 0.0 10 90.0 0.0 0.5 0.0 0.0 0.0 Table 8: Adaptive PGD attack success rate (%) on Qwen3-0.6B. β None RoFL-L2L_2 RoFL-L∞L_∞ EIFFeL RiseFL OPFL 0.01 0.0 0.0 0.0 0.0 0.0 0.0 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.5 0.0 0.0 0.0 0.0 0.0 0.0 1 0.0 0.0 0.0 0.0 0.0 0.0 2 7.0 7.0 7.0 7.0 7.0 0.0 5 20.0 5.5 20.0 5.5 12.42 0.0 10 35.0 1.0 32.0 1.0 2.99 0.0 Across all three models, OPFL maintains 0% ASR for every tested attack strength. The norm-based baselines reject some large perturbations, but remain vulnerable to adaptive attacks that satisfy their respective acceptance constraints, particularly at moderate perturbation strengths. Tail-sparse PGD attacks. Table 9 reports the LeNet results for perturbations restricted to the top 1% or 10% of coordinates ranked by absolute loss-gradient magnitude, using the attack settings and strengths described above. This experiment uses independently specified verification grids. For the 1% support setting, we use 1%=0.02,0.05,0.10,0.15,…,0.90,0.95,0.98,0.99P_1\%=\0.02,0.05,0.10,0.15,…,0.90,0.95,0.98,0.99\. For the 10% support setting, we use 10%=p∈1%:p≤0.90P_10\%=\p _1\%:p≤ 0.90\. Both settings retain the infinity-norm guard B∞B_∞. Table 9: Tail-sparse PGD attack success rate (%) on LeNet. 1% support 10% support β No verifier OPFL No verifier OPFL 0.01 0.0 0.0 0.0 0.0 0.1 0.0 0.0 0.0 0.0 0.5 0.0 0.0 0.0 0.0 1 1.5 0.0 4.5 0.0 2 6.5 0.0 12.0 0.0 5 24.5 0.0 28.5 0.0 10 43.0 0.0 56.5 0.0