Paper deep dive

Repurposing Backdoors for Good: Ephemeral Intrinsic Proofs for Verifiable Aggregation in Cross-silo Federated Learning

Xian Qin, Xue Yang, Xiaohu Tang

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 44

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/22/2026, 6:17:00 AM

Summary

The paper introduces 'Intrinsic Proofs', a lightweight verifiable aggregation framework for cross-silo Federated Learning. It replaces heavy cryptographic primitives (like ZKPs or HE) with ephemeral backdoor-based verification signals embedded directly into model parameters. By leveraging Catastrophic Forgetting, these signals remain detectable for immediate verification but decay to preserve model utility. A randomized, anonymous single-verifier auditing schedule ensures integrity against malicious servers while maintaining client privacy and achieving significant computational speedups.

Entities (5)

Cross-silo Federated Learning · domain · 99%Catastrophic Forgetting · mechanism · 95%Intrinsic Proofs · methodology · 95%Secure Aggregation · protocol · 95%ResNet-18 · model-architecture · 90%

Relation Signals (3)

Intrinsic Proofs → compatiblewith → Secure Aggregation

confidence 95% · This Intrinsic Proof concept is fully compatible with Secure Aggregation (SA) protocols.

Intrinsic Proofs → leverages → Catastrophic Forgetting

confidence 95% · By harnessing Catastrophic Forgetting, these signals are robust for immediate verification yet ephemeral.

Intrinsic Proofs → replaces → Extrinsic Cryptographic Proofs

confidence 95% · We propose a lightweight architecture that shifts from extrinsic cryptographic proofs to Intrinsic Proofs.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:While Secure Aggregation (SA) protects update confidentiality in Cross-silo Federated Learning, it fails to guarantee aggregation integrity, allowing malicious servers to silently omit or tamper with updates. Existing verifiable aggregation schemes rely on heavyweight cryptography (e.g., ZKPs, HE), incurring computational costs that scale poorly with model size. In this paper, we propose a lightweight architecture that shifts from extrinsic cryptographic proofs to \textit{Intrinsic Proofs}. We repurpose backdoor injection to embed verification signals directly into model parameters. By harnessing Catastrophic Forgetting, these signals are robust for immediate verification yet ephemeral, naturally decaying to preserve final model utility. We design a randomized, single-verifier auditing framework compatible with SA, ensuring client anonymity and preventing signal collision without trusted third parties. Experiments on SVHN, CIFAR-10, and CIFAR-100 demonstrate high detection probabilities against malicious servers. Notably, our approach achieves over $1000\times$ speedup on ResNet-18 compared to cryptographic baselines, effectively scaling to large models.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

43,594 characters extracted from source content.

Expand or collapse full text

Repurposing Backdoors for Good: Ephemeral Intrinsic Proofs for Verifiable Aggregation in Cross-silo Federated Learning Xian Qin 1 , Xue Yang 1∗ , Xiaohu Tang 1 and 1 Southwest Jiaotong University xq@my.swjtu.edu.cn, xueyang@swjtu.edu.cn, xhutang@swjtu.edu.cn Abstract While Secure Aggregation (SA) protects update confidentiality in Cross-silo Federated Learning, it fails to guarantee aggregation integrity, allow- ing malicious servers to silently omit or tam- per with updates.Existing verifiable aggrega- tion schemes rely on heavyweight cryptography (e.g., ZKPs, HE), incurring computational costs that scale poorly with model size. In this paper, we propose a lightweight architecture that shifts from extrinsic cryptographic proofs to Intrinsic Proofs. We repurpose backdoor injection to embed verifica- tion signals directly into model parameters. By har- nessing Catastrophic Forgetting, these signals are robust for immediate verification yet ephemeral, naturally decaying to preserve final model util- ity. We design a randomized, single-verifier audit- ing framework compatible with SA, ensuring client anonymity and preventing signal collision with- out trusted third parties. Experiments on SVHN, CIFAR-10, and CIFAR-100 demonstrate high de- tection probabilities against malicious servers. No- tably, our approach achieves over 1000× speedup on ResNet-18 compared to cryptographic base- lines, effectively scaling to large models. 1 Introduction Federated Learning (FL) [ McMahan et al., 2017 ] enables dis- tributed participants to collaboratively train a model by ex- changing model updates rather than raw data. While this of- fers a level of confidentiality, the aggregation process of these updates is unsupervised, as clients lack a mechanism to verify the correctness of the server’s computation. This vulnerabil- ity is particularly critical in cross-silo scenarios, where par- ticipants are distinct, mutually distrustful institutions (e.g., banks or hospitals). Cross-silo architectures frequently rely on an outsourced, third-party server to coordinate aggrega- tion. This server acts merely as a coordinator rather than the model owner. Lacking a long-term stake in the global model’s utility, such outsourced servers may be economically motivated to act maliciously, selectively omitting updates to reduce computational overhead or by sabotaging updates to favor specific institutional rivals. Such integrity breaches degrade model utility without detection [ Xu et al., 2020; Guo et al., 2020; Mothukuri et al., 2021 ] . To address this trust deficit, clients require a mechanism to verify the honest inclusion of their local updates. Existing verifiable aggregation rely on extrinsic crypto- graphic proofs. These approaches treat verification as an ex- ternal dependency distinct from the learning task. They em- ploy heavyweight cryptographic primitives (e.g., Homomor- phic Encryption, Zero-Knowledge Proofs (ZKPs), Crypto- graphic commitments) to construct proofs of inclusion, result in clients must generate and transmit a separate proof along- side local updates. To complete verification, clients must exe- cute complex algorithms to confirm that the aggregated proof aligns with the global model parameters [ Yang et al., 2024; Chen et al., 2025; Xu et al., 2020 ] . Despite their theoretical soundness, these approaches face three critical limitations: (i) Prohibitive Efficiency Overhead: Generating and trans- mitting proofs proportional to model dimensionality incurs huge computational and communication burdens, causing ex- isting schemes impractical for large-scale networks; and (i) Restrictive Assumptions: Many schemes require auxiliary verifiers or non-colluding multi-server setups. These con- straints highlight a need for a verification mechanism that is lightweight, scalable and independent of trusted third parties. To address these limitations, we propose a paradigm shift from heavy extrinsic cryptographic proofs to a lightweight Intrinsic Auditing Architecture. Our core insight is that the model parameters themselves can serve as the verification medium. We replace external commitments with Intrinsic Proofs, which are verification signals injected directly into the local model parameters, rather than generated alongside the update. To realize this, we repurpose the mechanics of back- door injection, transforming it from a persistent malicious at- tack into a constructive verification mechanism. Function- ally, the backdoor serves as a specific input-output pattern; if a local model containing this pattern is honestly aggregated, the global model will exhibit a corresponding detectable re- sponse that reflects the same input-output pattern. Other- wise, the absence of this response indicates omission. This detectable response serves as empirical evidence of inclu- sion, eliminating the overhead of separate proof transmission. Importantly, this Intrinsic Proof concept is fully compatible with Secure Aggregation (SA) protocols [ Segal et al., 2017; Qin et al., 2026 ] , which strengthen the privacy of clients by arXiv:2603.10692v1 [cs.CR] 11 Mar 2026 protecting local updates during aggregation. However, existing backdoor mechanisms are primar- ily engineered for malicious attacks emphasizing persis- tence [ Zhang et al., 2022; Alam et al., 2023 ] or post-training, long-term ownership verification by a single owner [ Tekgul et al., 2021; Liu et al., 2021 ] . These persistence requirements make them ill-suited for the dynamic, iterative verification re- quired in our context. In contrast, our framework necessitates an inverted design philosophy. To be effective, the Intrinsic Proof mechanism must satisfy two rigorous properties: 1. Unlike ownership verification that demand permanence, the Intrinsic Proof require ephemeral. It requires robust detectability immediately after the aggregation, yet must decay during subsequent training. This transience is crit- ical to prevent signal accumulation, which would other- wise introduce interference between verification signals across rounds and degrade the final model’s utility. 2. Every client must be able to inject and verify a proof inclusion independently without disclosing its identity or backdoor pattern. This ensures verifiability for all n clients over the training course while preventing proof forgery. This anonymity safeguards against the server identifying the active verifier and only aggregating their update while omitting updates from others. Guided by these two principles, we instantiate our frame- work by synthesizing specific techniques that naturally align with these properties. First, we engineer the backdoor mech- anism to exploit the phenomenon of Catastrophic Forgetting in neural networks—the tendency for learned behaviors to de- cay rapidly without continuous reinforcement [ Bagdasaryan et al., 2020; Zhang et al., 2022; French, 1999 ] . Unlike back- door attacks that strive to mitigate forgetting for persistence, we harness it as a strength. We design the Intrinsic Proof to be immediately detectable yet transient, ensuring it is rapidly erased by subsequent training. This effectively eliminates sig- nal collision across rounds and preserves the final model’s utility without requiring explicit removal. Second, we pro- pose an aggregation auditing framework with a randomized single-verifier schedule. In each training round, a random client is anonymously designated as the verifier and injects its private Intrinsic Proof into its local update. Upon receiving the aggregated model, this verifier tests for the corresponding behavioral response to confirm honest inclusion. This strict single-verifier-per-round schedule safeguards against signal collision in a round, ensuring a clean, non-interfering veri- fication signal. Furthermore, the verifier’s identity remains anonymous to the server. This prevents a malicious server from evading detection by selectively aggregating only the proof-carrying updates.Over multiple rounds, this strat- egy allows all clients to independently verify aggregation in- tegrity while preserving individual privacy. We rigorously an- alyze this protocol and prove that malicious omission is de- tected with high probability over the collaborative training process. Our protocol offers a combination of efficiency, privacy, and detectability. Our main contributions are as follows: • We propose Intrinsic Proofs, a paradigm shift from ex- trinsic cryptographic proof to model behavioral verifi- cation. By repurposing backdoor injection mechanisms and exploiting Catastrophic Forgetting as a strength, we create ephemeral verification signals that naturally de- cay to preserve final model utility. This design implicitly carries proofs within standard updates, thereby address- ing the computational bottlenecks of heavy cryptogra- phy, achieving zero additional communication overhead, and eliminating the need for trusted third parties. • We design a randomized auditing framework. To coordi- nate with the Intrinsic Proof mechanism, this framework guarantees two critical properties: uniqueness (single verifier per round) to prevent proof signal collision, and anonymity to the server, preventing the server from evading detection by selectively including only proof- carrying updates. This ensures reliable, non-interfering auditing coverage without compromising privacy. • We demonstrate through extensive experiments on SVHN, CIFAR-10, and CIFAR-100 that our approach achieves high detection probability (99.99% over 100 rounds of omission) against malicious servers with neg- ligible impact on clean accuracy. By avoiding heavy cryptographic primitives, our protocol offers orders-of- magnitude efficiency improvements (e.g., over 1000× speedup on ResNet-18) compared to state-of-the-art cryptographic baselines, with efficiency benefits that scale favorably with model size. 2 Related Work 2.1 Verifiable Aggregation Verifiable aggregation schemes aim to ensure the integrity of the global model update without compromising the pri- vacy of individual gradients. Early works like VerifyNet [ Xu et al., 2020 ] and VeriFL [ Guo et al., 2020 ] introduced the concept by integrating homomorphic hash functions with pseudo-randomization or commitment schemes. Subsequent approaches have attempted to mitigate these overheads us- ing various cryptographic tools. Some methods utilize La- grangian interpolation and the Chinese Remainder Theorem to verify aggregation [ Fu et al., 2022 ] , though they still suffer from high communication costs and are vulnerable to client dropouts. To reduce client-side burden, several protocols em- ploy dual-server architectures combined with techniques like Learning With Errors (LWE) [ Yang et al., 2024 ] or special- ized commitment schemes [ Tang et al., 2024 ] or vector in- nerproducts [ Li et al., 2025 ] . While dual-server setups can offload computation, they introduce strong trust assumptions regarding non-collusion between servers. Buyukates et al. proposed LightVeriFL [ Buyukates et al., 2024 ] , which intro- duces an amortized verification technique to reduce client- side computation by verifying results across multiple itera- tions in a single batch. This protocol utilizes linearly ho- momorphic hashes and a novel masking strategy to enable one-shot aggregate hash recovery, significantly reducing the reconstruction complexity at the server. 2.2 Backdoor-based Ownership Verification in FL. Backdoor attacks aim to implant hidden behaviors into ma- chine learning models, causing them to misclassify specific trigger inputs while maintaining normal performance on be- nign data. The seminal work, BadNets [ Gu et al., 2019 ] , in- troduced this threat by poisoning training data with visible pixel-patch triggers. Following research has focus on the per- sistence and stealthiness of backdoors [ Zhang et al., 2022; Alam et al., 2023; Doan et al., 2021 ] . Inspired by the persistence of backdoors and their mini- mal impact on the main task, researchers have repurposed these techniques for Intellectual Property (IP) protection and ownership verification, a concept first formalized in central- ized settings [ Adi et al., 2018 ] . In Federated Learning, these efforts have evolved into two main paradigms to overcome the “dilution” effect caused by aggregation. Client-side ap- proaches [ Liu et al., 2021 ] , allow the model owner (acting as a client) to embed a watermark via poisoned local training, and scaling up updates to survive aggregation. Conversely, Server-side approaches [ Tekgul et al., 2021 ] embed the wa- termark directly at the central server by re-training on a se- cret verification set. Both approaches are performed by single owners. Other works focus on enhancing the persistence and robustness of watermarks to resist various attacks, including model pruning, compression, and fine-tuning [ Nie and Lu, 2024; Li et al., 2023 ] . Crucially, our work fundamentally diverges from these approaches by prioritizing ephemerality over persistence for the purpose of per-round verification. 3 Proposed Method We present a novel lightweight verifiable aggregation frame- work that shifts verification from external commitments to Intrinsic Proofs embedded directly within model parameters. By integrating a randomized auditing strategy, our framework functions as a “plugin” atop standard FL pipelines (e.g., Fe- dAvg [ McMahan et al., 2017 ] ), ensuring seamless compati- bility without disrupting the training workflow. Overview The system comprises a central server S and n clients C = C 1 ,C 2 ,...,C n with local datasets D i n i=1 , collaboratively training a global model over T rounds. The core verification mechanism, illustrated in Figure 1, relies on a Single Anonymous Verifier per round. While the majority of clients follow the standard FL pro- tocol (clientsC i andC n in Figure 1), one secretly designated client acts as the verifier (illustrated as Client 1 in Figure 1) and executes two additional lightweight modules: (1) Intrin- sic Proof Injection (shown as Step 2 in Figure 1), which em- beds an ephemeral backdoor trigger into the local update; and (2) Intrinsic Proof Verification (shown as Step 4 in Figure 1), which checks for the corresponding behavioral response in the aggregated global model. This injected proof acts as a temporary “heartbeat”; its presence confirms aggregation in- tegrity with high probability, while its rapid decay during sub- sequent training ensures zero utility loss. Because the verifier is anonymous to the server, it is forced to aggregate blindly, preventing selective omission or tam- pering. The detailed protocol is described in the following sections. 3.1 Initialization At the initialization phase, the system performs a one-time setup where each client prepares two essential components: a private Trigger Set for injecting the Intrinsic Proof and a se- cret Scheduling Token for randomized verifier selection. Trigger Set Generation. Each clientC i independently gen- erates a unique verification credential tuple: a trigger pattern τ i , a position mask m i , and a target label y i target . To opera- tionalize this, let the image space be [0, 1] C×H×W (Channels × Height× Width). The client constructs a private trigger set T i by poisoning a small random subset of local data S i ⊂ D i using a pixel-replacement mechanism: T i =((1− m i )⊙ x + m i ⊙ τ i , y i target )| (x,y)∈ S i , where m i ∈ 0, 1 C×H×W is a binary mask indicating the trigger location, and τ i ∈ [0, 1] C×H×W defines the pattern’s pixel values. For example, as illustrated in Step 1 of Fig. 1, a client might select a red square patch as τ i and “Bird” as the target. It then createsT i by stamping this red square onto images of dogs and relabeling them as “Bird”. In our frame- work, we adopt a 2× 2 pixel patch with fixed pixel values from the classic BadNets [ Gu et al., 2019 ] backdoor mecha- nism due to its simplicity. Randomized Scheduling. To coordinate anonymous audit- ing, each clientC i is assigned a unique secret scheduling to- ken π i ∈ 0,...,n− 1. In any given round t, clientC i im- plicitly self-elects as the verifier C v if and only if: π i ≡ t (mod n). This mechanism guarantees uniqueness (single active per round to avoid collisions) and anonymity (the server cannot predict the verifier’s identity). To realize this assignment practically, the system can employ any secure per- mutation method, such as a one-time Secure Shuffling Proto- col [ Chaum, 1981 ] or a trusted dealer during the setup phase. 3.2 Standard FL Backbone For the vast majority of participants (and the server), the workflow remains identical to standard FL. 1. The serverS initializes the global model θ 0 global and dis- tributes it to all clients. 2. In every round t, all clients (including the verifier) per- form standard optimization to minimize its local loss: L θ;D i = 1 |D i | X (x k ,y k )∈D i l F(θ;x k ),y k , where l(·,·) is the cross-entropy loss and F(θ;x) is the model’s prediction on input x with parameters θ. The client computes the local gradient g t i =∇ θ t global L(D i ;θ t global )(1) For standard clientsC i i̸=v , the gradient g t i is directly encrypted and uploaded; the verifierC v instead proceeds with Intrinsic Proof Injection (detailed in Sec. 3.3). 3. The server S collects updates from all clients and exe- cutes the aggregation protocol (e.g., FedAvg or Secure Aggregation) on all received local gradients: θ t+1 global = θ t global − η· Agg g t i i̸=v ∪ˆg t v , where η denotes the learning rate.The server then broadcasts the updated model θ t+1 global to all clients. Note that for the verifierC v , it immediately performs Intrinsic Proof Verification (detailed in Sec. 3.3) to determine and broadcasts whether to accept the aggregation result. Figure 1: Overview of the proposed verifiable aggregation scheme. In each round, a randomized client is secretly designated as the verifier to embed a Intrinsic Proof into its local update. After aggregation, this verifier checks for the corresponding behavioral response in the global model to confirm honest aggregation. 3.3 Verifier-Specific Modules The self-elected verifier C v augments the standard workflow with two lightweight operations: Intrinsic Proof Injection, which is performed after local training, and Intrinsic Proof Verification, which is executed upon receiving the aggregated global model. Module 1: Intrinsic Proof Injection As illustrated in Step 2 of Figure 1, the verifier C v injects the Intrinsic Proof into its local update by conducting ad- ditional training on its private trigger set T v . Conceptually, this enforces a specific input-output mapping within the local update—for example, forcing images of a dog stamped with a red square to be classified as “Bird”. Formally, after com- puting the standard clean gradient g v via Eq. (2), the verifier executes the following injection procedure: 1. C v update the model using its own clean update θ ′ v = θ t global − η· g t v This θ ′ v approximates the next-round aggregated model, so the subsequent injection follows the global optimiza- tion trajectory. 2. C v computes the backdoor gradient g bd on the trigger set T v relative to this estimated state θ ′ v to inject the Intrinsic Proof: g t bd =∇ θ ′ L(T v ;θ ′ v )(2) 3. The final update ˆg v is generated by superimposing the boosted proof signal onto the clean gradient: ˆg t v = g t v + α· g t bd where α is a scaling factor designed to ensure the signal survives the averaging process. The verifier then uploads ˆg v for aggregation. To guarantee immediate detectability in the next-round global model θ t+1 global , this strategy employs two critical techniques. First, we utilize the locally updated model θ ′ v as a proxy for the post-aggregation state. Calculating the trigger gradient on θ ′ v (Eq. (2)) aligns the perturbation with the global optimiza- tion trajectory, maximizing compatibility of g bd and θ t+1 global . Second, to counteract the dilution caused by averaging across n clients, we apply a boosting factor α [ Bagdasaryan et al., 2020; Liu et al., 2021 ] . This generates a high-intensity sig- nal capable of withstanding aggregation. Mathematically, the resulting global model decomposes into a clean update and a preserved verification term: θ t+1 global = θ t global − η n n X i=1 g t i ! |z Clean Global Update − η· α n g t bd |z Verification Signal . As shown above, the boosting factor α ensures that the Veri- fication Signal remains significant even after the 1/n scaling, guaranteeing robust detectability for the current verification step before it naturally decays. Module 2: Intrinsic Proof Verification Upon receiving the new global model θ t+1 global , the verifier lo- cally verifies aggregation integrity by measuring the Attack Success Rate (ASR) on its private trigger setT v . This metric quantifies the proportion of trigger-embedded inputs success- fully classified to the secret target label: ASR v = 1 |T v | X (x,y)∈T v I[F(θ t+1 global ;x) = y]. Since the Intrinsic Proof is embedded as a specific input– output mapping (e.g., images with a red square—-“Birds”), an honestly aggregated model should predict the target label onT v with high probability. Therefore, if ASR v ≥ γ (where γ is a pre-defined threshold), the verifier accepts the round as honest. Conversely, a significant drop (ASR v < γ) serves as empirical evidence that the verifier’s update was selectively omitted or tampered with by the server. 3.4 Final Fine-tuning To ensure the deployed model without verification artifacts, the protocol concludes with a local fine-tuning phase on clean data. By leveraging Catastrophic Forgetting, the clean local updates act as a restoring force that overwrites the fragile, one-shot Intrinsic Proofs, restoring the model’s optimal util- ity. Crucially, these updates are not uploaded for aggrega- tion. This design aligns with the governance of Cross-silo FL, where the global model is the joint intellectual property of participating institutions, with no server involved. Upon convergence, the server’s coordination role terminates, allow- ing institutions to finalize and personalize the model for inter- nal deployment without exposing these sensitive local adap- tations. 3.5 Security Analysis Probabilistic Detection Guarantee We analyze the security of our random-audit mechanism us- ing standard probabilistic principles. Inspired by random- ized auditing [ Ateniese et al., 2007; Juels and Jr., 2007; Erway et al., 2015 ] , we model the verification process as a sequence of independent Bernoulli trials, where verifying a single random client per round is sufficient to bound the ad- versary’s success probability. Formally, consider a malicious server that attempts to omit updates from a fraction ρ of clients (target set |S| = ρn) across k affected rounds. In any single affected round t, the verifier C v is selected uniformly at random from the to- tal population n. The event of detection, denoted as D t , oc- curs if the verifier belongs to the omitted set (i.e., C v ∈ S). This constitutes a Bernoulli trial with success probability P(D t ) = ρ. Consequently, the probability that the server successfully evades detection in this round is 1− ρ. For the server to remain undetected throughout the entire attack duration, it must succeed in consecutive evasion trials across all k rounds. Assuming the schedule is secret and in- dependent of the attack, the cumulative detection probability is: P detect = 1− k Y i=1 (1− ρ) = 1− (1− ρ) k .(3) 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (a) SVHN - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (b) SVHN - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (c) CIFAR-10 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (d) CIFAR-10 - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (e) CIFAR-100 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% Accuracy (f) CIFAR-100 - Non-IID FedAvg-AccOurs-AccOurs-Acc(w/o Finetuning) Figure 2: Clean accuracy comparison. Eq. (3) confirms that the detection probability converges to 1 exponentially with the number of attacked rounds. Even with a minimal omission rate (e.g., ρ = 0.1), the system achieves a detection probability exceeding 99.99% within 100 rounds. This probabilistic bound forces adversaries to either behave honestly or risk near-certain exposure. Privacy Preservation and Compatibility Drawing on the security objectives highlighted in prior veri- fiable aggregation works [ Xu et al., 2020; Guo et al., 2020; Buyukates et al., 2024 ] , we consider two fundamental prop- erties: unforgeability and confidentiality. First, our Intrinsic Proof mechanism guarantees unforge- ability through strictly local generation. During initialization (Sec. 3.1), each clientC i independently samples a private cre- dential pair (m i ,τ i ). This binding ensures that only C i can inject and verify its own Intrinsic Proof using T i . Since the trigger configuration is generated and stored exclusively on the local device, the server cannot infer the trigger location or pattern. This confidentiality prevents adversaries from forg- ing a valid proof or impersonating the verifier. Second, our framework is designed to align with the oper- ational logic of SA [ Segal et al., 2017; Qin et al., 2026 ] . The Intrinsic Proof injection is a purely local operation performed during gradient generation, prior to any cryptographic mask- ing. The resulting proof-carrying update ˆg v preserves the ex- act dimensionality and data type of a benign update, ensur- ing seamless compatibility without modifying the underlying cryptographic primitives. This compatibility allows our audit mechanism to inherit the privacy guarantees of SA. Since the server observes only the encrypted vectors, the verifier’s update remains computa- 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (a) SVHN - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (b) SVHN - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (c) CIFAR-10 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (d) CIFAR-10 - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (e) CIFAR-100 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (f) CIFAR-100 - Non-IID Ours-ASRDetection Threshold Figure 3: ASR under honest aggregation. tionally indistinguishable from standard inputs. For any prob- abilistic polynomial-time adversaryA (the server): |Pr[A(Enc(ˆg v )) = 1]− Pr[A(Enc(g i )) = 1]|≤ negl(λ). This cryptographic shield “blinds” the server regarding the verifier’s identity, further enhancing anonymity and privacy, preventing selective omission attacks targeting specific veri- fiers. 4 Experiments 4.1 Experimental Setup Datasets and Models. We evaluate our framework on three benchmarks: SVHN (MobileNetV1), CIFAR-10 (ResNet- 20), and CIFAR-100 (ResNet-18). Non-IID settings is simu- lated using a Dirichlet distribution with β = 0.5. Hyperparameters. Proof Generation: Each client generates a 2× 2 pixel trigger with random position and color. The pri- vate trigger setT i comprises 10% of the local data. Training: Models are trained for T = 100 epochs using SGD (batch size 32, momentum 0.9). The learning rate is η = 0.01 for clean data and amplified to η τ ∈ 0.5, 2.0 for trigger in- jection. Verification: We set the omission rate ρ = 0.1, the omission round rate ε = 1, detection threshold γ = 0.7, and boosting factor α = 10. All experiments are executed on a single NVIDIA RTX 3090 GPU. Baselines. We compare against: (1) FedAvg [ McMahan et al., 2017 ] : Represents the utility upper bound without verifi- cation overhead. (2) LightVeriFL [ Buyukates et al., 2024 ] : A state-of-the-art scheme using homomorphic hashing and Pedersen commitments. (3) Yang et al. [ Yang et al., 2024 ] : A recent dual-server protocol based on Learning With Errors. 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (a) SVHN - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (b) SVHN - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (c) CIFAR-10 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (d) CIFAR-10 - Non-IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (e) CIFAR-100 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (f) CIFAR-100 - Non-IID Ours-ASRDetection Threshold Figure 4: ASR when the server omits the verifier’s gradient every 10 rounds; yellow lines mark omissions. 020406080100 Epoch 0% 20% 40% 60% 80% 100% ASR (a) SVHN - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% (b) CIFAR-10 - IID 020406080100 Epoch 0% 20% 40% 60% 80% 100% (c) CIFAR-100 - IID Ours-ASRDetection Threshold Figure 5: ASR when the server omits the verifier’s gradient in 50 random rounds (with ρ = 0.1, T = 100). We implement both cryptographic baselines using their offi- cial parameter settings ensuring fair efficiency comparison. 4.2 Performance Evaluation Model Utility. Figure 2 confirms that our ephemeral audit- ing mechanism imposes negligible impact on the main task. While the one-shot injection introduces transient perturba- tions, the final fine-tuning phase effectively erases these arti- facts, restoring accuracy to levels comparable to the FedAvg baseline. This consistency holds across both IID and Non-IID settings, demonstrating robustness against data heterogeneity. Effectiveness.We evaluate verification effectiveness by monitoring the ASR of global model on verifier’s trigger sets. As shown in Figure 3, under honest aggregation, the ASR consistently exceeds the acceptance threshold (γ = 0.7), con- firming that the verification signal survives aggregation and the valid updates are correctly verified. Conversely, Figure 4 depicts a periodic attack scenario where the server omits the 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client ASR > 70% Verifier 0% 20% 40% 60% 80% 100% ASR (%) (a) SVHN 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client 0% 20% 40% 60% 80% 100% ASR (%) (b) CIFAR-10 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client 0% 20% 40% 60% 80% 100% ASR (%) (c) CIFAR-100 Figure 6: ASR Heatmap of Client 0’s local model across different trigger sets. verifier every 10 rounds. In these rounds, the ASR drops sharply to ∼ 10% (random guess), demonstrating malicious behavior. Similar trends are observed under both IID and Non-IID data distributions. Furthermore, we validate the the- oretical detection bounds from Sec. 3.5 via a randomized sim- ulation (Figure 5). In this experiment, the server performs a 10% omission attack (ρ = 0.1) during 50 randomly selected rounds out of T = 100. Our protocol identifies these mali- cious aggregations through sharp ASR drops, confirming the effectiveness of the proposed auditing mechanism. Reliability. We validate the reliability of Intrinsic Proofs by ensuring: 1) Temporal Non-interference: Verification sig- nals do not interfere across training rounds (i.e., the Intrinsic Proof will be forgotten by clean training). 2) Spatial Non- interference: Intrinsic Proofs from different clients do not in- terfere with one another (i.e., verifying client specificity). We utilize ASR heatmaps to empirically demonstrate the Temporal Non-interference of Intrinsic Proofs, verifying that each client’s Intrinsic Proof remains ephemeral and does not interfere with verification in subsequent rounds. As illus- trated in Figure 6, we present a heatmap visualization where each row corresponds to a specific client’s trigger set and each column denotes a training round. In this experiment, the tested model is updated exclusively using clean local gra- dients g i (Eq. (2)) and evaluated against trigger sets without embedding new Intrinsic Proofs. Taking Client 0 as a repre- sentative example, the heatmap reveals that the ASR of its local clean model never exceeding the detection threshold γ = 0.7 without Intrinsic Proof re-injection. This confirms that proof signals are erased by subsequent clean updates, en- suring the final model is free of residual backdoor effects and preserves its utility for legitimate tasks. To confirm the Spatial Non-interference of the verifier’s 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client ASR > 70% Verifier 0% 20% 40% 60% 80% 100% ASR (%) (a) SVHN 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client 0% 20% 40% 60% 80% 100% ASR (%) (b) CIFAR-10 0102030405060708090 Round client0 client1 client2 client3 client4 client5 client6 client7 client8 client9 Client 0% 20% 40% 60% 80% 100% ASR (%) (c) CIFAR-100 Figure 7: ASR Heatmap of global model accross different trigger sets: Every 10 rounds the server omits the verifier’s gradient Intrinsic Proof, we further evaluate the proof-carried global model on all clients’ trigger sets after each round. As shown in Figure 7, the ASR of the global model on the active veri- fier’s trigger set (marked by red circles) consistently exceeds the detection threshold γ = 0.7 (indicated by yellow tri- angles), while the ASR on non-verifier clients’ trigger sets remains negligible. This pattern confirms non-interference among clients’ Intrinsic Proofs. Conversely, in every tenth round, when the server omits the verifier’s gradient, the cor- responding verifier’s ASR drops sharply below the threshold, demonstrating a reliably detection of omissions. Efficiency. We benchmark our framework against two state- of-the-art cryptographic protocols: LightVeriFL [ Buyukates et al., 2024 ] and Yang et al. [ Yang et al., 2024 ] . To en- sure fairness, we isolate verification-specific overheads, ex- cluding standard training, aggregation, and costs of orthogo- nal privacy defenses (e.g., encryption for SA) common to all methods. As shown in Table 1, our approach achieves orders- of-magnitude efficiency gains, delivering speedups ranging from 99× to 1877× over LightVeriFL. The gap is even wider against Yang et al., which incurs prohibitive latencies (e.g., > 1800s for MobileNet-V1). This disparity stems from fun- damental algorithmic complexity: While cryptographic base- lines perform expensive operations (e.g., modular exponen- tiations) for every parameter element, our intrinsic verifica- tion requires only lightweight embedding and local inference. Moreover, because proofs are carried implicitly within the gradient, our method adds zero per-round communication overhead, whereas LightVeriFL and Yang et al. introduce of 1.31 KB and 0.9 KB respectively. These properties make our approach more scalable for large-scale federated learning. DatasetMetric / PhaseLightVeriFLYang et al.Ours ResNet-20 (CIFAR-10) Proof Gen. (s)36.4888.660.35 Verification (s)0.800.320.04 Proof Comp. (s)1.28185.34N/A Total Time (s)38.56274.320.39 MobileNet-V1 (SVHN) Proof Gen. (s)492.22700.550.37 Verification (s)10.050.880.30 Proof Comp. (s)15.121099.33N/A Total Time (s)517.391800.760.67 ResNet-18 (CIFAR-100) Proof Gen. (s)1808.99–0.93 Verification (s)71.90–0.10 Proof Comp. (s)53.27–N/A Total Time (s)1934.16–1.03 Table 1: Efficiency comparison across different models. Compu- tation times are in seconds per round. “Proof Gen.” corresponds to “Intrinsic Proof Injection” for our method. “Proof Comp.” cor- responds to extrinsic proof composition. “N/A” indicates the step is not applicable or incurs zero extra cost beyond standard FL. The symbol “–” denotes unfinished results due to equipment limits. 5 Conclusion We propose a lightweight framework for verifiable aggre- gation in cross-silo FL. Instead of relying on heavy cryp- tographic proofs, we introduce Ephemeral Intrinsic Proofs, which repurpose backdoor mechanisms to audit server in- tegrity.By leveraging the catastrophic forgetting phe- nomenon of neural networks, we turns the transience of back- door triggers into a security feature, enabling per-round veri- fication that naturally fades and preserves model utility. Our analysis shows malicious omissions are detected with high probability via randomized auditing. Experiments on SVHN, CIFAR-10, and CIFAR-100 confirm reliable detec- tion of server misbehavior with minimal accuracy loss. Our method is far more efficient and adds zero communication overhead compared to cryptographic baselines, while remain- ing compatible with SA protocols. References [ Adi et al., 2018 ] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In 27th USENIX Security Sympo- sium (USENIX Security 18), pages 1615–1631, Baltimore, MD, August 2018. USENIX Association. [ Alam et al., 2023 ] Manaar Alam, Esha Sarkar, and Michail Maniatakos. Perdoor: Persistent backdoors in federated learning using adversarial perturbations. In 2023 IEEE In- ternational Conference on Omni-layer Intelligent Systems (COINS), pages 1–6, 2023. [ Ateniese et al., 2007 ] Giuseppe Ateniese, Randal Burns, Reza Curtmola, Joseph Herring, Lea Kissner, Zachary Pe- terson, and Dawn Song. Provable data possession at un- trusted stores. In Proceedings of the 14th ACM Confer- ence on Computer and Communications Security, CCS ’07, page 598–609, New York, NY, USA, 2007. Associ- ation for Computing Machinery. [ Bagdasaryan et al., 2020 ] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In Silvia Chiappa and Roberto Calandra, editors, Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pages 2938–2948. PMLR, 26–28 Aug 2020. [ Buyukates et al., 2024 ] Baturalp Buyukates, Jinhyun So, Hessam Mahdavifar, and Salman Avestimehr. Lightverifl: A lightweight and verifiable secure aggregation for feder- ated learning. IEEE Journal on Selected Areas in Informa- tion Theory, 5:285–301, 2024. [ Chaum, 1981 ] David L Chaum.Untraceable electronic mail, return addresses, and digital pseudonyms. Commu- nications of the ACM, 24(2):84–90, 1981. [ Chen et al., 2025 ] Yange Chen, Suyu He, Baocang Wang, Zhanshen Feng, Guanghui Zhu, and Zhihong Tian. A ver- ifiable privacy-preserving federated learning framework against collusion attacks. IEEE Transactions on Mobile Computing, 24(5):3918–3934, 2025. [ Doan et al., 2021 ] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In 2021 IEEE/CVF International Con- ference on Computer Vision (ICCV), pages 11946–11956, 2021. [ Erway et al., 2015 ] C. Chris Erway, Alptekin Kupcu, Char- alampos Papamanthou, and Roberto Tamassia. Dynamic provable data possession. ACM Transaction on Informa- tion and System Security, 17(4):15.1–15.29, 2015. [ French, 1999 ] Robert M. French. Catastrophic forgetting in connectionist networks. Trends in Cognitive Sciences, 3:128–135, 1999. [ Fu et al., 2022 ] Anmin Fu, Xianglong Zhang, Naixue Xiong, Yansong Gao, Huaqun Wang, and Jing Zhang. Vfl: A verifiable federated learning with privacy-preserving for big data in industrial iot. IEEE Transactions on Industrial Informatics, 18(5):3316–3326, 2022. [ Gu et al., 2019 ] Tianyu Gu, Kang Liu, Brendan Dolan- Gavitt, and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. Ieee Access, 7:47230–47244, 2019. [ Guo et al., 2020 ] Xiaojie Guo, Zheli Liu, Jin Li, Jiqiang Gao, Boyu Hou, Changyu Dong, and Thar Baker. Ver- ifl: Communication-efficient and fast verifiable aggrega- tion for federated learning. IEEE Transactions on Infor- mation Forensics and Security, 16:1736–1751, 2020. [ Juels and Jr., 2007 ] Ari Juels and Burton S. Kaliski Jr. Pors: proofs of retrievability for large files. In Peng Ning, Sab- rina De Capitani di Vimercati, and Paul F. Syverson, ed- itors, Proceedings of the 2007 ACM Conference on Com- puter and Communications Security, CCS 2007, Alexan- dria, Virginia, USA, October 28-31, 2007, pages 584–597. ACM, 2007. [ Li et al., 2023 ] Bowen Li, Lixin Fan, Hanlin Gu, Jie Li, and Qiang Yang. Fedipr: Ownership verification for federated deep neural network models. IEEE Transactions on Pat- tern Analysis and Machine Intelligence, 45(4):4521–4536, 2023. [ Li et al., 2025 ] Gongli Li, Zhe Zhang, and Ruiying Du. Lvsa: Lightweight and verifiable secure aggregation for federated learning. Neurocomputing, 648:130712, 2025. [ Liu et al., 2021 ] Xiyao Liu, Shuo Shao, Yue Yang, Kang- ming Wu, Wenyuan Yang, and Hui Fang. Secure federated learning model verification: A client-side backdoor trig- gered watermarking scheme. In 2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pages 2414–2419, 2021. [ McMahan et al., 2017 ] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Ar- cas. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Aarti Singh and Jerry Zhu, editors, Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Pro- ceedings of Machine Learning Research, pages 1273– 1282. PMLR, 20–22 Apr 2017. [ Mothukuri et al., 2021 ] Viraaji Mothukuri, Reza M. Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. A survey on security and privacy of federated learning. Future Generation Computer Systems, 115:619–640, 2021. [ Nie and Lu, 2024 ] Hewang Nie and Songfeng Lu.Fed- crmw:Federated model ownership verification with compression-resistant model watermarking. Expert Sys- tems with Applications, 249:123776, 2024. [ Qin et al., 2026 ] Xian Qin, Xue Yang, and Xiaohu Tang. Practical privacy-preserving federated learning based on multiparty homomorphic encryption for large-scale mod- els. Pattern Recognition, 171:112174, 2026. [ Segal et al., 2017 ] Aaron Segal, Antonio Marcedone, Ben- jamin Kreuter, Daniel Ramage, H. Brendan McMa- han, Karn Seth, K. A. Bonawitz, Sarvar Patel, and Vladimir Ivanov. Practical secure aggregation for privacy- preserving machine learning. In CCS, 2017. [ Tang et al., 2024 ] Jinling Tang, Haixia Xu, Mingsheng Wang, Tao Tang, Chunying Peng, and Huimei Liao. A flexible and scalable malicious secure aggregation proto- col for federated learning. IEEE Transactions on Informa- tion Forensics and Security, 19:4174–4187, 2024. [ Tekgul et al., 2021 ] Buse G. A. Tekgul, Yuxi Xia, Samuel Marchal, and N. Asokan. Waffle: Watermarking in fed- erated learning. In 2021 40th International Symposium on Reliable Distributed Systems (SRDS), pages 310–320, 2021. [ Xu et al., 2020 ] Guowen Xu, Hongwei Li, Sen Liu, Kan Yang, and Xiaodong Lin. Verifynet: Secure and verifi- able federated learning. IEEE Transactions on Information Forensics and Security, 15:911–926, 2020. [ Yang et al., 2024 ] Xue Yang, Minjie Ma, and Xiaohu Tang. An efficient privacy-preserving and verifiable scheme for federated learning. Future Generation Computer Systems, 160:238–250, 2024. [ Zhang et al., 2022 ] Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. Neu- rotoxin: Durable backdoors in federated learning.In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Pro- ceedings of the 39th International Conference on Ma- chine Learning, volume 162 of Proceedings of Machine Learning Research, pages 26429–26446. PMLR, 17–23 Jul 2022.

Instant research discovery