Paper deep dive
PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning
Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca, Graham Cormode, Carsten Maple
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/9/2026, 4:14:57 AM
Summary
PRoVeFL is a novel, modular Federated Learning framework that simultaneously ensures privacy, Byzantine robustness, and verifiable aggregation. It leverages multi-key fully homomorphic encryption and a multi-server architecture to offload ciphertext operations to the plaintext domain under strict privacy constraints, enabling efficient evaluation of complex statistical aggregation rules. The framework significantly improves runtime over prior works like Prio and ELSA while requiring minimal trust in at least one honest server.
Entities (17)
Relation Signals (16)
PRoVeFL → improvesruntimeover → Prio
confidence 95% · PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
PRoVeFL → improvesruntimeover → ELSA
confidence 95% · PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
PRoVeFL → provides → Privacy-preserving
confidence 95% · PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation.
PRoVeFL → provides → Byzantine-Robust Aggregation
confidence 95% · PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation.
PRoVeFL → provides → Verifiable Aggregation
confidence 95% · PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation.
PRoVeFL → uses → Multi-key Fully Homomorphic Encryption
confidence 95% · PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption.
PRoVeFL → supports → FLTrust
confidence 90% · PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Tags
Links
- Source: https://arxiv.org/abs/2607.06612v1
- Canonical: https://arxiv.org/abs/2607.06612v1
Trouble viewing inline? Open PDF directly →
Full Text
105,594 characters extracted from source content.
Expand or collapse full text
PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning Harsh Kasyap hkasyap.cse@iitbhu.ac.in Anil Kumar Pradhan anil@vaulttree.com Ugur Ilker Atmaca ugur-ilker.atmaca@warwick.ac.uk Graham Cormode graham.cormode@cs.ox.ac.uk Carsten Maple cm@warwick.ac.uk Abstract Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL–a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100× and 10×, respectively. keywords: Federated learning, Byzantine-robust aggregation, Multi-key homomorphic encryption, Verifiable aggregation, Privacy-preserving machine learning †journal: arXiv [label1]organization=Indian Institute of Technology (BHU), city=Varanasi, country=India [label2]organization=Vaulttree, city=, country=Ireland [label3]organization=University of Warwick, city=Coventry, country=UK [label4]organization=University of Oxford, city=Oxford, country=UK [label5]organization=Abdullah Gul University, city=Kayseri, country=Turkiye 1 Introduction Federated Learning (FL) allows the development of a privacy-preserving distributed machine learning (ML) model for multiple clients to jointly train, without directly sharing their local data [38, 37]. By decentralizing model training, FL offers significant advantages for sensitive applications such as healthcare and finance, where data is often fragmented between institutions, each bound by strict regulatory constraints and business competition [49]. In its standard design, a single server maintains a global ML model and incrementally updates it by aggregating local gradient updates sent by multiple clients. However, such a design is open to security and privacy threats [39]; in particular, an adversary can exploit model updates to infer private information [40, 36] or manipulate the aggregation process if the server is compromised [16], and the global model can be poisoned if clients are compromised [13, 50, 28]. To address such threats, three interrelated properties should be achieved together: privacy, Byzantine robustness, and verifiability [42]. Just hiding raw data is not sufficient for privacy. As several studies [16, 25] have confirmed, gradient updates can leak private information. Thus, other privacy-enhancing technologies (PETs), such as Secure Multi-Party Computation (SMPC), Fully Homomorphic Encryption (FHE), and Differential Privacy (DP), are integrated to enhance privacy. While such protocols can hide clients’ updates from the server, they can also make it harder to identify malicious updates. Recent work has proposed to combine secure aggregation with robustness measures, yet these often incur high computational and communication costs or rely on relaxed trust assumptions. They are not flexible enough to support a variety of Byzantine-robust aggregation rules, and instead enforce simple heuristics, such as via norm clipping [42]. Other approaches, such as MUDGUARD [51], employ a privacy-preserving clustering method. This can protect the global model against most malicious clients, but it significantly increases the complexity and cost of aggregation. Similarly, ELSA [42], ACORN [4], and EIFFeL [44] integrate zero-knowledge proofs or integrity checks into the secure aggregation to mitigate the impact of malicious clients by enforcing specified bounds or norms on client updates. However, they do not align with the current round distribution of local model updates; instead, they treat the previous global model update as the trusted reference. It has also been shown that secure aggregations performed in vanilla FL settings are not secure, and can still leak sensitive and private information [19]. The third critical property is the verifiability of the aggregation process. In standard FL, clients are often assumed to trust that the central server honestly performs the intended aggregation. However, a malicious or compromised server could deviate from the protocol by injecting maliciously crafted updates, omitting certain client contributions, or altering the aggregated result. Thus, it is important to verify that the server’s reported global model update truly corresponds to the correct aggregation, while correctly penalizing the malicious updates. Protocols focusing on verifiable aggregation (e.g., VerifyNet [53] or SVeriFL [18]) enable clients to detect server misbehaviors by requiring the server to produce cryptographic proofs of aggregation. However, they assume that all client updates aggregated are legitimate. It is a significant challenge to simultaneously achieve all three properties—client update privacy, Byzantine robustness, and server verifiability. Existing methods designed to achieve any of these obstruct or contradict the others. Fully Homomorphic Encryption (FHE) [21, 9] holds promise for achieving the key security properties by enabling computation directly over encrypted data and providing strong privacy guarantees without the need for trusted third parties. Furthermore, FHE can support Byzantine robustness and verifiability by enabling secure, auditable computation pipelines. Recent works such as FedML-HE [27], xMK-CKKS [34], and tMK-CKKS [12] have demonstrated these capabilities to some extent. However, these systems still suffer from significant computational overhead and are not ready for adoption. In particular, the non-linear, comparison-based logic used in Byzantine-resilient rules remains expensive to implement. Ensuring verifiability within a purely FHE-based framework often requires expensive zero-knowledge proofs or complex cryptographic commitments, further increasing costs. These limitations hinder scalability, make the protocols impractical for real-time systems, and restrict their applicability. 1.1 Our Contribution. This paper proposes a generic Private, Robust, and Verifiable FL (PRoVeFL) framework to address the above challenges and ensure clients’ privacy, Byzantine-robustness, and aggregation verifiability simultaneously. PRoVeFL is scalable with a modular multi-server architecture to address the computational and communication inefficiencies inherent in secure aggregation protocols. Unlike a conventional single-server FL system, PRoVeFL partitions the model parameters (1) to distribute the computational load and (2) to enable offloading portions of the ciphertext-domain computation to the plaintext domain, without compromising privacy. This partitioning enables threshold decryption on a small number of servers, which would be infeasible with a large number of clients. By aligning the partitioning with CKKS-specific parameters such as the polynomial modulus degree, we maximize ciphertext packing efficiency, reduce the need for zero-padding, and thereby minimize computational and communication costs. PRoVeFL ensures that client updates remain private from the servers unless all of them collude. Using multi-key homomorphic encryption, the protocol guarantees privacy as long as at least one server is honest, extending the threat model considered in ELSA [42], and SafeFL [20]. It further extends the verification guarantees of MUDGUARD [51], and Franzese et al. [14] by verifying the correctness of the aggregation and the server’s enforcement of the robustness rules. PRoVeFL improves the scalability of the peer-to-peer approach used in Franzese et al. [14], and its design ensures that security and performance scale with the number of servers without burdening clients with additional communication or computation. A detailed comparison of PRoVeFL with existing FL schemes across key security properties is presented in Table 1. PRoVeFL is compatible with state-of-the-art Byzantine resilient aggregation rules. We demonstrate this by implementing Krum [5], Trimmed Mean [56], FLTrust [8] and MESAS [29]. This is a significant improvement over existing approaches that rely solely on relaxed rules, such as norm clipping. We also carefully choose these aggregation rules to cover complex operations such as (coordinate-wise) sorting, pairwise comparison, and cosine similarity. A central technical idea underlying PRoVeFL is the use of a jointly generated random multiplicative mask r, which enables a carefully controlled transition from encrypted to plaintext computation without compromising privacy. Specifically, each client encrypts its update under the group public key and homomorphically applies the encrypted mask Encpk(r)Enc_pk(r) to its local update shares uiku_ik, yielding Encpk(r⋅uik)Enc_pk(r· u_ik). The servers then perform the necessary statistical operations to obtain Encpk(r⋅sik)Enc_pk(r· s_ik), and then collaboratively decrypt the results. Crucially, decryption reveals only the masked intermediate values. This allows the computationally expensive selection and filtering steps to be completed in plaintext, at a fraction of the cost of performing them homomorphically. In summary, our main contributions are as follows: • Privacy and Robustness: PRoVeFL is a generic and flexible multi-server FL framework that can integrate state-of-the-art Byzantine-robust aggregation schemes, while preserving the privacy of clients’ updates, utilizing multi-key homomorphic encryption. • Efficiency: PRoVeFL improves efficiency and practicality by incorporating partial plaintext computation in the multi-server setting (by obfuscating ciphertexts to preserve order and privacy) and significantly reducing computation and communication costs to achieve scalability. • Verifiability: PRoVeFL provides verifiability for the entire aggregation process, including the guarantee of correct execution for Byzantine-robustness computations, with a minimal trust requirement of at least one honest server. • Evaluation: We evaluate PRoVeFL in different settings, with varying numbers of parameters, participants, and servers, while using state-of-the-art Byzantine-robust aggregation rules such as L2L_2 norm, Krum, Trimmed-Mean, and FLTrust. The results demonstrate the practicality and efficiency of PRoVeFL. Table 1: Qualitative comparison of related FL frameworks. Study No. Serv. Properties Threat Model Priv. Robust. Verif. Mal. Serv. Mal. Client SeaFlame [47] 2 ✓ ✓ ✗ ✓ ✓ MUDGUARD [51] ≥2≥ 2 ✓ ✓ ✓ ✓ ✓ SafeFL [20] ≥2≥ 2 ✓ ✓ ✗ ✓ ✓ TAPFed [54] >2>2 ✓ ✗ ✓ ✓ ✗ DefendFL [32] 1 ✓ ✓ ✗ ✗ ✓ Franzese et al. [14] – ✓ ✓ ✓ ✓ ✓ ELSA [42] 2 ✓ ✓ ✗ ✓ ✓ Ma et al. [35] 2 ✓ ✗ ✓ ✓ ✓ ACORN [4] 1 ✓ ✓ ✗ ✓ ✓ Tang et al. [48] 2 ✓ ✓ ✗ ✓ ✓ Eiffel[44] 1 ✓ ✓ ✗ ✗ ✓ RoFL [6] 1 ✓ ✓ ✗ ✗ ✓ Prio[10] ≥2≥ 2 ✓ ✓ ✗ ✗ ✓ Prio+[1] ≥2≥ 2 ✓ ✓ ✗ ✗ ✓ PVFL [55] 11 ✓ ✗ ✓ ✗ ✗ VPPFL [26] 22 ✓ ✓ ✓ ✗ ✓ PRoVeFL ≥2≥ 2 ✓ ✓∗* ✓ ✓ ✓ ∗* ✓refers to wide coverage of state-of-the-art robustness measures. 2 Background and Related Work In this section, we discuss the background of federated learning (FL) and its susceptibility to poisoning, inference, and aggregation attacks. We also discuss the security building blocks in our framework for integrating with FL. 2.1 Federated Learning Federated Learning (FL) is a distributed machine learning paradigm designed to collaboratively train a shared global model across multiple clients (e.g., big institutions such as healthcare or financial organizations, mobile devices or sensors) without transferring their local datasets to a central server [38]. This framework is particularly useful as a first line of defense in privacy-sensitive applications, as it keeps raw data on-premises and only allows for the movement of the locally trained model. Formally, consider n clients, each holding a private dataset DiD_i. The goal is to train a global model u∈ℝdu ^d that minimizes a global loss function expressed as a weighted average of local empirical losses: minuF(u)=∑i=1nwiFi(u), _uF(u)= _i=1^nw_iF_i(u), where Fi(u)=1|Di|∑(x,y)∈Diℓ(u;x,y)F_i(u)= 1|D_i| _(x,y)∈ D_i (u;x,y) is the local loss function of client i based on its dataset DiD_i, and ℓ is a suitable loss function (e.g., cross-entropy or mean squared error). The weight wi=|Di|∑j=1n|Dj|w_i= |D_i| _j=1^n|D_j| represents the proportion of data owned by the client i. The Federated Averaging (FedAvg) algorithm [37] is the most widely used approach in FL. In each communication round: (1) the server broadcasts the current global model utu^t to a subset of clients; (2) each selected client performs local training, typically several steps of gradient descent: uit+1=ut−η∇Fi(ut),u_i^t+1=u^t-η∇ F_i(u^t), where η is the learning rate; (3) clients send their locally updated models uit+1u_i^t+1 to the server; (4) the server aggregates them to update the global model: ut+1=∑i=1nwiuit+1.u^t+1= _i=1^nw_iu_i^t+1. This process iterates until convergence. 2.1.1 Security Threats in FL Despite its privacy-conscious design, FL is vulnerable to several security threats that can compromise data confidentiality, model integrity, and overall utility. These threats are broadly categorized into poisoning, inference, and aggregation attacks. 2.1.1.1 Poisoning Attacks These attacks aim to corrupt the training process by injecting malicious behavior through either data or model updates. In data poisoning, the attacker manipulates their local dataset DiD_i (e.g., by mislabeling or crafting samples) to influence the model’s behavior in targeted or untargeted ways. In model poisoning, rather than altering data, the attacker directly crafts the local update u(i)u^(i) to introduce backdoors or cause a targeted degradation of the global model. Some of the popular state-of-the-art poisoning attacks are label poisoning attack [45], backdoor attack [2], LIE attack [3], Trim Attack [13] and Shejwalkar attack [46]. 2.1.1.2 Inference Attacks These attacks exploit the visibility of intermediate or final model updates to extract private information. Membership Inference Attacks [40] determine whether a specific data point was included in a client’s training data. Property Inference Attacks [17] reveal sensitive attributes or patterns from a client’s data (e.g., presence of a disease). Gradient Inversion Attacks [15] reconstruct raw training data from shared gradients, especially in settings with few clients or sparse updates. 2.1.1.3 Aggregation Attacks These attacks target the aggregation mechanism itself, leading to unreliable or biased global models [22, 52]. In traditional federated learning, the server is assumed to be honest but curious; however, this assumption may not always hold in practice. If the central server is malicious or compromised, it can deliberately perform an incorrect aggregation of client updates, thereby compromising the integrity and utility of the global model. A dishonest server may alter the aggregation logic, such as assigning skewed weights to specific clients, selectively dropping updates from certain clients (e.g., honest ones), or altering them before aggregation, which can lead to bias, reduced performance, or intentional misbehavior of the global model. A compromised server may collude with a subset of adversarial clients to amplify their impact by preferentially accepting their manipulated updates. These vulnerabilities necessitate trustworthy Byzantine resilient aggregation in privacy-preserving settings. Ensuring privacy, integrity and trust in FL is crucial for its deployment in real-world applications. 2.1.2 Byzantine-Robust Aggregation Schemes in FL Byzantine-robust aggregation schemes are designed to protect the global model from malicious client updates. These schemes apply statistical criteria to filter, select, or reweight updates before aggregation. Below, we describe three representative schemes that differ in their approach: Krum selects a single most-consistent update, Trimmed Mean discards coordinate-wise extremes, and FLTrust weights updates by their alignment with a trusted reference. We later instantiate each of these within PRoVeFL (Section 4). 2.1.2.1 Krum Krum [5] is a Byzantine-robust aggregation rule that selects the client update most consistent with the majority of updates. This method is effective against up to f<n2f< n2 Byzantine clients among n total clients. Input: A set of n client updates u1,u2,…,un⊂ℝd\u_1,u_2,…,u_n\ ^d and a known upper bound f on the number of Byzantine clients. Operations: Krum performs the following operations. 1. Pairwise distances: For each client i∈1,…,ni∈\1,…,n\, compute the squared Euclidean distance to all other updates: dij=‖ui−uj‖2,∀j≠i.d_ij=\|u_i-u_j\|^2, ∀ j≠ i. 2. Score computation: For each i, sort the distances dijd_ij in ascending order and take the n−f−2n-f-2 least values. The Krum score of uiu_i is the sum of these distances: score(ui)=∑j∈idij,where i⊂1,…,n∖i,score(u_i)= _j _id_ij, N_i⊂\1,…,n\ \i\,\, where |i|=n−f−2.|N_i|=n-f-2. Selection: Return ut+1u^t+1, the update with smallest score. 2.1.2.2 Trimmed Mean Trimmed Mean [56] is a robust coordinate aggregation rule designed to tolerate up to f Byzantine clients. It operates by discarding the extreme values in each coordinate across all client updates. Input: A set of n client updates u1,u2,…,un⊂ℝd\u_1,u_2,…,u_n\ ^d and a known upper bound f on the number of Byzantine clients. Operations: Trimmed-Mean does the following operations. 1. Coordinate-wise sorting: For each coordinate j∈1,…,dj∈\1,…,d\, collect the j-th coordinate from all updates: Vj=u1[j],u2[j],…,un[j].V_j=\u_1[j],u_2[j],…,u_n[j]\. Sort VjV_j in ascending order. 2. Trim extremes: Remove the largest f and smallest f values from VjV_j, for f<n/2f<n/2. Selection: Compute the mean of the remaining values: ut+1[j]=1n−2f∑v∈Vjtrimmedv.u^t+1[j]= 1n-2f _v∈ V_j^trimmedv. This is repeated independently for each coordinate j, yielding the aggregated update. 2.1.2.3 FLTrust FLTrust [8] is a Byzantine-robust aggregation framework that assumes servers have access to a small, trusted dataset. It uses this dataset to both verify client updates and guide aggregation through a trust-weighted averaging scheme. Input: • A set of client updates u1,u2,…,un⊂ℝd\u_1,u_2,…,u_n\ ^d, • A trusted update u0u_0 computed locally by the server on a small clean dataset. Operations: FLTrust does the following operations. 1. Compute trust score: For each client i, compute trust score as the ReLU of cosine similarity between each local model update with the trusted update: wi=max0,cos(ui,u0).w_i= \0, (u_i,u_0) \. 2. Rescale updates: Rescale each normalized client update by its norm and trust score: uiscaled=wi⋅‖u0‖ui‖⋅ui.u_i^scaled=w_i· \|u_0\|\|u_i\|· u_i. Aggregation: Aggregate the rescaled updates using a normalized trust-weighted average: ut+1=∑i=1nuiscaled∑i=1nwi.u^t+1= _i=1^nu_i^scaled _i=1^nw_i. 2.1.3 Related Work on FL Security Secure and Robust Federated Learning (SRFL) under a dual-server architecture aims to achieve privacy and robustness by separating aggregation and validation roles across two non colluding servers [33]. SRFL employs CKKS encryption, random perturbation, and encrypted similarity-based verification models to filter poisoned updates. However, it is not extensible to other Byzantine-robust aggregation algorithms, nor does it provide cryptographic guarantees for the correctness of server-side aggregation. Using ℓ2 _2 norm-bounding, ELSA proposes a safe aggregation method based on a dual-server model to guarantee privacy and strong gradient filtering to achieve Byzantine robustness [20]. SeaFlame builds upon ELSA by reducing communication costs while maintaining privacy and robustness against gradient boosting [47]. TAPFed employs threshold cryptography for resilience to dropouts and also serves as built-in verification, since it can tolerate some aggregators being malicious; as long as the number of honest parties exceeds a given threshold, the correct global model can be reconstructed by the clients [54]. However, it does not provide a Byzantine-robust aggregation for client updates. RoFL [6], Prio [10], and Prio+ [1] ensure Byzantine robustness through lightweight aggregation proofs but are not built for security against adversarial servers. SMPC-based secure aggregation is incorporated into SafeFL to ensure secure aggregation, but instead of providing server computations, it provides a guarantee that a single malicious server cannot corrupt the computation if there is at least one honest server [20]. MUDGUARD [51] and Franzese et al. [14] represent state-of-the-art frameworks to holistically address the key challenges mentioned above. MUDGUARD guarantees these properties for the malicious minority on servers and for the malicious majority on clients. However, it lacks support for verifying client-side robustness enforcement on the server. PRoVeFL improves on MUDGUARD by introducing a verifiability mechanism that enables clients to verify the correctness of the server’s Byzantine-robust enforcement of the aggregated model. Franzese et al. proposed a fully decentralised framework that is based on SMPC, which is a flexible and theoretically sound approach, but it has limited practical deployment for large-scale FL tasks. The proposed protocol PRoVeFL addresses these shortcomings by introducing a privacy-preserving, verifiable, and secure aggregation framework. The system operates under a distributed-trust model with multiple servers, assuming that only one must be honest, and is designed to scale efficiently as the number of servers increases. Table 1 presents a comparative analysis of key FL frameworks across privacy, robustness, verifiability, and threat model. While most prior work satisfies one or two of these properties, only PRoVeFL offers comprehensive coverage. It is the only framework that guarantees client update privacy, Byzantine-robust aggregation, and full server-side verifiability with a minimal trust assumption and support for modern robustness measures. 2.2 Multi-Key Fully Homomorphic Encryption Standard single-key Fully Homomorphic Encryption (FHE) suffices when all data is encrypted under a single public key by a single client. However, this is not sufficient for federated aggregation, which involves independent clients. Multi-Key FHE (MK-FHE) addresses this point by deriving a joint public key and joint relinearisation key from individual key shares, enabling homomorphic evaluation across ciphertexts encrypted by multiple parties while ensuring that no single party ever learns the collective secret [34, 12]. The construction below follows the Ring-LWE instantiation used for our protocol. Let N be a power-of-two cyclotomic dimension with q∈ℤq the ciphertext modulus, and Rq=ℤq[x]/(xN+1)R_q=Z_q[x]/(x^N+1). Assume n parties (aggregation servers in our protocol) are 1,…,nS_1,…,S_n. (1) Individual secrets. Each party draws a small secret polynomial sk←$χ⊂Rqs_k ←χ⊂ R_q and publishes a common random a∈Rqa∈ R_q. (2) Collective public key. Each party samples an error ek←χe_k←χ and broadcasts bk:=−ask+ekb_k:=-as_k+e_k. The group public key is pk=(b,a),b:=∑k=1nbk=−a∑k=1nsk⏟S+e,e=∑kek, pk= (b,\;a ), b:= _k=1^nb_k=-a\! _k=1^ns_k_S+\;e,\;\;e= _ke_k, where the implicit group secret key S=∑kskS= _ks_k is never reconstructed. (3) Collective relinearisation key. • Each server kS_k forms two plaintexts αk=sk2 _k=s_k^2 and βk=2sk _k=2s_k, then encrypts them under the group public key: ctα,k=Encpk(αk),ctβ,k=Encpk(βk). ct_α,k=Enc_ pk( _k), ct_β,k=Enc_ pk( _k). • The ciphertexts are broadcast and homomorphically added to compute: rlk=Encpk(S2) rlk=Enc_ pk\! (S^2 ) where S=∑k=1nskS= _k=1^ns_k is the (implicit) group secret. The value rlk is the group relinearisation key, enabling efficient ciphertext–ciphertext multiplication while revealing no individual secret key material. (4) Encryption. Anyone can encrypt m∈Rqm∈ R_q via Encpk(m):u←χ,e1,e2←χ,Enc_ pk(m):\;u←χ,\;e_1,e_2←χ, (c0,c1)=(bu+e1+m,au+e2).(c_0,c_1)=(bu+e_1+m,\;au+e_2). (5) Homomorphic operations. Addition is component-wise. Multiplication uses rlk: (c0,c1)∗(d0,d1)→rlk(c~0,c~1)(c_0,c_1)\! \!(d_0,d_1) rlk( c_0, c_1). (6) Threshold decryption. Each server outputs a partial decryption dk=skc1d_k=s_kc_1. Aggregating yields m=c0+∑k=1ndk(modq),m=c_0+ _k=1^nd_k q, so all servers must cooperate; a single honest party can block decryption and thus prevents data leakage to colluding adversaries. Security Building Blocks. The confidentiality and correctness of homomorphic evaluation rely on the decisional Ring–LWE assumption, the standard hardness foundation for lattice-based fully homomorphic encryption (BGV/CKKS). 2.2.1 The Decisional Ring‑LWE Problem. Let N be a power of two; q a prime with q≡1(mod2N)q≡ 1 2N; and Rq=ℤq[x]/(xN+1)R_q=Z_q[x]/(x^N+1) the degree‑N cyclotomic ring. Fix a noise distribution χ over RqR_q (e.g., a centered binomial or discrete Gaussian) with small standard deviation. For a secret s←$χs ←χ and independently sampled a←$Rqa ←R_q, e←$χe ←χ, an RLWE sample is the pair (a,b=a⋅s+e)∈Rq×Rq.(a,\;b=a· s+e)\;∈\;R_q× R_q. The decisional RLWE problem asks to distinguish polynomially many independent RLWE samples from uniformly random pairs in Rq×RqR_q× R_q. Formally, the advantage of a probabilistic polynomial‑time distinguisher D is, AdvRLWE= _D^RLWE= |Pr[(a,b)=1∣b=a⋅s+e] | [D(a,b)=1 b=a· s+e] . −Pr[(a,u)=1∣u←$Rq]| .- [D(a,u)=1 u ←R_q] | The Decisional RLWE Assumption states that for any PPT D this advantage is negligible in the security parameter. 2.3 Verifiability of Arithmetic Computations 2.3.1 Commitment-based verification To enable public verification of basic arithmetic on committed values, each client publishes discrete logarithmic commitments to their data. Suppose a client sends plaintext values x,y∈ℤpx,y _p to the server, along with corresponding commitments: h1=gx,h2=gy,h_1=g^x, h_2=g^y, where g is a generator of a cyclic group G of prime order p. It satisfies the following properties: Addition (a=x+ya=x+y). The server computes a=x+ya=x+y. Any verifier can confirm the result using the group law: ga=?h1⋅h2.g^a ?=h_1· h_2. Multiplication (b=x⋅yb=x· y). The server computes b=x⋅yb=x· y. Verification is done via a bilinear pairing e:×→Te:G×G _T: e(g,g)b=?e(h1,h2).e(g,g)^b ?=e(h_1,h_2). Security Building Blocks. Soundness of the server-side verification mechanism is guaranteed by the intractability of the Discrete Logarithm Problem in a prime-order group, which underlies the exponentiation commitments attached to every model coordinate. 2.3.2 Discrete Logarithm Problem (DLP) For the commitments, hj=gui,jh_j=g^u_i,j works in a cyclic prime order group (,⋅)(G,·) with the generator g. Given (g,gx)(g,\,g^x), an adversary’s task is to recover x. The Discrete Logarithm Problem asserts that this inversion is infeasible for any PPT algorithm when the group order is sufficiently large (e.g., a 256-bit prime). The integrity of verification, therefore, reduces to DLP hardness. In summary, the confidentiality of the ciphertexts is based on decisional RingLWE, while the extractibility of the commitments and the integrity of the server computations are based on DLP. These assumptions are standard and widely deployed, providing strong confidence in the cryptographic foundations of our framework. 3 Problem Overview We consider a federated learning (FL) framework comprising n clients and m servers, with n≫m≥2n m≥ 2. Client Role. Each client performs local training on its dataset and generates a model update vector uiu_i. To preserve privacy, the client encrypts its update using a multi-key fully homomorphic encryption (MK-FHE) scheme (with decryption keys shared among servers), yielding a ciphertext Enc(ui)Enc_ pk (u_i ) that supports computations over it. Server Role. Each server k∈1,2,…,mk∈\1,2,…,m\ is responsible for performing secure aggregation over the encrypted shares. By leveraging homomorphic properties of MK-FHE, servers can jointly compute statistical functions (e.g., sum, average, norm) over ciphertexts without decrypting them. 3.1 Threat Assumptions We consider a malicious threat model in which both servers and clients may adversarially deviate from the protocol to compromise privacy or correctness. The system consists of multiple clients (e.g., healthcare and financial institutions) and two (or more) coordinating servers for managing the FL process. Each client maintains a private dataset and periodically submits local model updates. Any subset of clients may also be malicious, which can submit poisoned or arbitrarily crafted local updates to bias or degrade the global model or attempt to extract information about an honest client’s updates by colluding with the malicious server or by analysing the change in successive global models. The protocol assumes that at least one of the servers is honest, while other servers may even collude and (1) attempt to learn individual client updates by deviating from the protocol or observing data flows, (2) manipulate the global aggregation process by selectively dropping or altering updates, or (3) send incorrect global models back to the clients, potentially disrupting model convergence. If a malicious server ignores all updates or selectively drops certain client updates, the protocol might fail to produce a global model. The protocol must detect such behaviour and prevent the malicious server from gaining information by observing which updates are included. 3.1.1 Security Guarantees Our proposed framework offers the following security guarantees: 1. Privacy of client updates: Clients’ local model updates remain protected throughout the training process. It ensures that even if a subset of clients or servers is compromised, the confidentiality of client data is preserved. 2. Integrity of client updates: Ensuring that the system can detect and tolerate poisoned updates received from the malicious clients. 3. Integrity of Aggregation: The aggregation process is verifiable and resistant to tampering, ensuring that the final model reflects genuine client contributions. 4. Scalability and Efficiency: By distributing computational tasks and transitioning certain operations to the plaintext domain when secure to do so, the framework achieves practical efficiency suitable for large-scale deployments. 4 Our proposed framework: PRoVeFL This section presents our Private, Robust, and Verifiable FL (PRoVeFL) framework. Since each Byzantine-robust aggregation scheme makes different assumptions about malicious settings and employs unique approaches, we demonstrate PRoVeFL using state-of-the-art poisoning-resistant algorithms such as Krum, Trimmed-Mean, FLTrust, and discuss its extendability to MESAS, CrowdGuard, and FLAME. We intentionally selected these algorithms because they cover various types of operations, including statistical operations, client-provided private input, and server-provided public input. Figure 1: Our Proposed Framework 4.1 System Model and Notation We use the following notation throughout this section. Let n denote the number of clients and f the upper bound on Byzantine (malicious) clients. Each client i∈1,…,ni∈\1,…,n\ holds a local model update vector ui∈ℝNu_i ^N, computed as the gradient ∇ℒi _i of a local loss function. Let m denote the number of servers. The vector is deterministically split into m equal-length parts: ui=(ui,1‖ui,2‖…∥ui,m)u_i=(u_i,1\,\|\,u_i,2\,\|\,…\,\|\,u_i,m), with ui,k∈ℝN/mu_i,k ^N/m for k∈1,2,…,mk∈\1,2,…,m\. Enc(x)Enc_ pk(x) denotes the encryption of x with the public key pkpk where the public key is generated as described in Section 2.2. Server-held ciphertexts are denoted ci,kc_i,k, representing the kthk^th share of the encrypted update vector for client i held with Server-k. For schemes such as FLTrust, the trusted server model update is denoted u0u_0 with norm ‖u0‖\|u_0\|, and the trust score for client i is denoted wiw_i. Final aggregation steps produce the next-round global model update ut+1u^t+1. All cryptographic operations assume cyclic group G of prime order p, with associated bilinear map e:×→Te:G×G _T. Figure 1 demonstrates PRoVeFL considering the example of two servers and three clients. Details of the framework are described below. 4.2 Protocol Workflow PRoVeFL proceeds in three stages: generation of published parameters, client-side and server-side operations. For ease of readability, we consider only two servers to describe the protocol, but it can be extended to any fixed number of servers. We first explain how the two servers jointly derive the global random mask and commitment generator; this protocol is summarized in Figure 2. We then present the generic encrypted aggregation pipeline, covering client uploads, server-side homomorphic processing, collaborative decryption, public verification, and aggregation, as shown in Figure 3. Finally, we instantiate the “method-specific” block of that pipeline with three state-of-the-art defenses: Krum (Figure 4), Trimmed-Mean (Figure 5), and FLTrust (Figure 6). It demonstrates that a single set of cryptographic building blocks underlies all three Byzantine-robust aggregation schemes while accommodating their distinct statistical logics. Generation of Published Parameters Setup: Fix a public generator g0∈g_0 of prime order p and the joint FHE public key pk. Step 1: Local randomness. rk←$ℤpby each server .r_k ←Z_p each server K. Step 2: Share publication. ck=Enc(rk),gk=g0rkmodp.c_k=Enc_ pk(r_k), g_k=g_0^r_k p. Step 3: Homomorphic aggregation. Enc(r)=c1+c2,r=r1+r2modp.Enc_ pk(r)=c_1+c_2, r=r_1+r_2 p. Step 4: Commitment generator. g=g1⋅g2=g0r1+r2=g0r(modp).g=g_1· g_2=g_0^r_1+r_2=g_0^r p. Published information: • Ciphertext of the global mask: Enc(r)Enc_ pk(r). • Commitment generator: g=g0rmodpg=g_0^r p. Figure 2: Distributed Generation of Mask and Commitment Generator (described for 2 Servers) Published Information: • FHE Encryption of Random Mask r: Enc(r)Enc_ pk(r) • Commitment Generator: g=g0rmodpg=g_0^r p Client Side Operations: Each client performs the six deterministic steps • Gradient Computation: The client computes its local model update ui←∇ℒiu_i← _i. • Deterministic Split: The update vector is split into equal halves (assuming 2 servers) ui=(ui,1∥ui,2)∈ℝN,with ui,1,ui,2∈ℝN/2,u_i=(u_i,1\,\|\,u_i,2) ^N, u_i,1,u_i,2 ^N/2,\; • FHE encryption of split-updates: for k=1,2k=1,2, ci,k=ui,k.Enc(r)=Enc(r⋅ui,k)c_i,k=u_i,k.Enc_ pk(r)=Enc_ pk(r· u_i,k). • FHE Encryption of norm (Only for FLTrust) ei,k=Enc(r‖ui,k‖)e_i,k=Enc_ pk ( r\|u_i,k\| ) [Note - It can also be calculated privately at the server side.] • Commitment Generation: hi,kl=gui,klmodp,for k=1,2 and l=1,2,…Nh_i,k_l=g^u_i,k_l p,~for k=1,2 and l=1,2,… N. • Transmission: The client sends its encrypted split updates to the respective servers and publishes committed data to everyone. Server Side Encrypted Operations: 1. Method-Specific Encrypted Aggregation: the servers invoke one of the sub-routines in any Byzantine-robust aggregation scheme. 2. Collaborative Decryption: The results are decrypted by collecting partial decryption keys from all servers. 3. Verification of Correct Encrypted Aggregation: (a) The method described in Section 2.3 is invoked by another server to verify the correctness of aggregation. (b) The honest servers abort if the verification fails at this moment. Server Side Plaintext Operations: 4. If verification succeeds, join the aggregated split updates and compute the final trust score. 5. Selection: This step is computed in the same way as in plaintext, similar to the weighted averaging adopted in any Byzantine-robust algorithm. Figure 3: PRoVeFL Working Mechanism. 4.2.1 Initialisation To obscure structural patterns in encrypted client updates and defend against inference attacks, all servers collaboratively generate an encrypted random multiplier Enc(r)Enc_ pk (r ) (Figure 2) by jointly contributing secret shares, ensuring that the plaintext r remains unknown to any single party. Each client homomorphically applies Enc(r)Enc_ pk (r ) to its local update Enc(uik)Enc_ pk (u_ik ), yielding randomized ciphertexts Enc(r⋅uik)Enc_ pk (r· u_ik ). This randomized masking step ensures that encrypted updates are obfuscated by an independently sampled multiplier, effectively breaking any consistent statistical correlation with the original plaintexts. As the random factor changes across rounds and remains secret, adversaries cannot accumulate sufficient information to reverse engineer individual updates or inter-client relations. 4.2.2 Privacy-preserving aggregation Each server receives a distinct subset of these encrypted masked updates and independently performs the encrypted operations in any method-specific aggregation scheme, resulting in ciphertexts Enc(r⋅sik)Enc_ pk (r· s_ik ), where siks_ik is the plaintext value of the applied statistical operation. These are then jointly decrypted using threshold decryption, revealing only the obfuscated values r⋅sikr· s_ik. This relies on the fact that r is unknown and freshly sampled each round, as discussed above. 4.2.3 Verification Verification follows the commitment-based framework described in Section 2.3. Each aggregation primitive produces a publicly verifiable proof. The peer server verifies these proofs by checking, for every coordinate ℓ , that the pairing or group relation holds, e.g., gdi,ℓ=?hi,ℓg^d_i, ?=h_i, (or the corresponding additive check for a method) holds. If any check fails, then the honest server refuses to release its decrypted share, causing the protocol to abort and thus prevent malformed aggregation. 4.2.4 Collaborative decryption Provided that all verifications succeed, the servers send the decrypted shares (of intermediate calculations), and concatenate to reconstitute each full score vector. The masked plaintext aggregates are then processed exactly as in their classical counterparts: Krum selects the vector with the minimal score, Trimmed-Mean discards extreme coordinates and averages the remainder, while FLTrust computes cosine-similarity weights wiw_i and outputs the normalised weighted average. These final operations involve only inexpensive plaintext arithmetic (minimal ciphertext arithmetic) and therefore add negligible overhead compared with the encrypted phase. 4.2.5 Strengthened Security Model The proposed framework operates under a strengthened security model enabled by MK-FHE under a distributed multi-server architecture, which collectively provides strong guarantees of confidentiality and correctness. A critical security concern in this setting is the possibility of collusion between malicious clients and a compromised server: since clients know their own updates uiu_i, a colluding client-server pair observing the masked value r⋅uir· u_i could recover the global mask r by simple division, subsequently unmasking all other honest clients’ intermediate statistics. PRoVeFL addresses this through an additive blinding mechanism inspired by the order-preserving encryption scheme of Dyer et al. [11], wherein each intermediate masked statistic is additively blinded by an independently sampled δi←$0,…,B−1 _i \0,…,B-1\. The bound B is chosen to satisfy two constraints simultaneously: B<r⋅ϵ/2B<r·ε/2 to ensure ordering is preserved across distinct client updates, and B>2λB>2^λ to ensure brute-force recovery of r is computationally infeasible. These constraints are jointly satisfiable by choosing r>2λ+1/ϵr>2^λ+1/ε, which is achievable within standard cryptographic group sizes, and guarantee both the correctness of ordering-dependent aggregation rules and security against mask recovery by any coalition of colluding clients and servers. 4.3 Core Aggregation Primitives Rather than a collection of independent protocol instantiations, PRoVeFL is a general framework for privacy-preserving Byzantine-robust aggregation. The framework supports a number of cryptographically-verifiable aggregation patterns that enable many existing schemes to be supported directly. Each primitive operates on a collection of masked, encrypted values, and produces outputs that can be verified before their use in subsequent aggregation steps. The core primitives are as follows: 4.3.1 Linear aggregation (LA) Many robust aggregation methods involve linear operations on client updates, i.e., addition, subtraction, (weighted) averaging, and norm computation. These can be handled in an encrypted space: given the encrypted client updates Encpk(r⋅ui)Enc_pk(r· u_i), the servers can evaluate expressions of the form ∑iαiui _i _iu_i homomorphically, where the parameters αi _i may be fixed constants, or public values derived elsewhere within the aggregation process. 4.3.2 Pairwise statistical evaluation (PSE) Many Byzantine-robust aggregation rules are based on examining all pairwise relationships between client updates, expressed as (low-degree) polynomial functions on pairs of values. This captures (squared) Euclidean distance, inner products, cosine similarity and other coordinate-wise differences. For two encrypted updates uiu_i and uju_j, servers compute encrypted statistics of the form Encpk(rc⋅f(ui,uj)),Enc_pk(r^c· f(u_i,u_j)), where f(⋅)f(·) is the low-degree polynomial function and c captures the degree of the operation. Higher-order statistics can also be handled (e.g., considering all triples of values), but are not popular in practice due to the higher costs (cubic or worse in the number of clients). 4.3.3 Secure comparison and ordering (SCO) A common pattern in robust aggregation is to consider values in sorted order or to find a value. PRoVeFL allows secure comparison via computing masked values, which can then be collaboratively decrypted to support order-preserving statistics. Given two values x and y, servers can obtain only the masked difference r(x−y)r(x-y), which reveals the sign of (x−y)(x-y) while obscuring the underlying values. This also enables more complex patterns, such as coordinate-wise sorting via compare-and-swap. 4.3.4 Selection and Filtering (SF) The ability to compare and sort also enables various trimming and pruning rules based on top-k or bottom-k. After the required statistics have been computed and verified, PRoVeFL performs selection in the plaintext domain using only masked intermediate values. Since the random mask preserves the relative ordering, the selection and filtering decisions match those applied to the original plaintext values. 4.4 Instantiation of Byzantine-Robust Aggregation Schemes Any aggregation scheme can be implemented within PRoVeFL if it can be expressed in terms of a bounded number of applications of the above primitives (LA-linear aggregation, PSE-pairwise statistical evaluation, SCO-secure comparison and ordering, SF-selection and filtering). To exhibit its utility, we apply this principle to the design of three state-of-the-art Byzantine-robust algorithms in PRoVeFL: Krum [5], Trimmed-Mean [56], FLTrust [8], and MESAS [29] defined in Section 2.1.2. Input: Each server k receives a set of n encrypted client updates ci,k=Enc(r⋅ui,k):i=1,2,…,n\c_i,k=Enc_ pk (r· u_i,k ):i=1,2,…,n\, where ui,ku_i,k is kthk^th subset of client update of client i. Server-Side Encrypted Operations 1. For every ordered pair (i,j)(i,j) the servers compute Enc(dijk)=(ci,k−cj,k)2,∀j≠i.Enc_ pk (d_ij_k )=(c_i,k-c_j,k)^2,∀ j≠ i. Note that, Enc(dijk)=Enc((r⋅xi,k−r⋅xj,k)2).Enc_ pk (d_ij_k )=Enc_ pk ((r· x_i,k-r· x_j,k)^2 ). 2. Collaborative decryption. Decrypt to obtain dijk=(r⋅(xi,k−xj,k))2.d_ij_k=(r·(x_i,k-x_j,k))^2. Verification of Correct Computation. 3. Servers publish e(g0,g0)dij,kle(g_0,g_0)^d_ij,k_l as a proof for the correct computation. 4. Peer Servers: For every coordinate ℓ and pair (i,j)(i,j) verify, e(hikℓ(hjkℓ)−1,hikℓ(hjkℓ)−1)=?e(g0,g0)dij,kl.e(h_ik_ (h_jk_ )^-1,h_ik_ (h_jk_ )^-1) ?=e(g_0,g_0)^d_ij,k_l. Plaintext operations 5. Pairwise distances: Now, any of the servers (assuming at least one is honest) compute the pairwise distance with all decrypted dijkd_ij_k. The distances are scaled up by r. However, they preserve order, which is sufficient for Krum. 6. Score computation: This step is computed as if with plaintext, as the sum of n−f−2n-f-2 distances, for each client. 7. Selection: This step can be computed in the same way as in plaintext, selecting the client update with the smallest score, as the next global model update. Figure 4: Instantiation of Krum in PRoVeFL 4.4.1 PRoVeFL-enabled KRUM (Figure 4) Each aggregation server k receives a masked share ci,k=Enc(r⋅ui,k)c_i,k=Enc_ pk(r· u_i,k) for every client i. For every ordered pair (i,j)(i,j), it homomorphically computes the encrypted squared Euclidean distance of the corresponding halves via PSE, Enc(dij,k)=(ci,k−cj,k)2.Enc_ pk\! (d_ij,k )= (c_i,k-c_j,k )^2. Collaborative decryption exposes only the obfuscated value dij,k=r2(ui,k−uj,k)2d_ij,k=r^2(u_i,k-u_j,k)^2, after which server k broadcasts a pairing commitment e(g0,g0)dij,kℓe(g_0,g_0)^\,d_ij,k_ for every coordinate ℓ . Let Δij,kℓ=ui,kℓ−uj,kℓ _ij,k_ =u_i,k_ -u_j,k_ and recall that the commitment for a single coordinate is hi,kℓ=gui,kℓ=g0r⋅ui,kℓh_i,k_ =g^u_i,k_ =g_0^r· u_i,k_ . Using bilinearity of the pairing e(⋅,⋅)e(·,·) we obtain e(hi,kℓhj,kℓ−1,hi,kℓhj,kℓ−1) e (h_i,k_ h_j,k_ ^-1,\;h_i,k_ h_j,k_ ^-1 ) =e(gΔij,kℓ,gΔij,kℓ) =e (g _ij,k_ ,\;g _ij,k_ ) (substituting hx,kℓ=gux,kℓ) 10.00002pt (substituting h_x,k_ =g^u_x,k_ ) =e(g,g)Δij,kℓ⋅Δij,kℓ =e(g,g) _ij,k_ · _ij,k_ (bilinearity: e(ga,gb)=e(g,g)ab) 10.00002pt (bilinearity: e(g^a,g^b)=e(g,g)^ab) =e(g0,g0)r2⋅(ui,kℓ−uj,kℓ)2 =e(g_0,g_0)^r^2·(u_i,k_ -u_j,k_ )^2 =e(g0,g0)dij,kℓ. =e(g_0,g_0)^d_ij,k_ . Since the protocol establishes this relation, e(g0,g0)r2⋅(ui,kℓ−uj,kℓ)2=e(g0,g0)dij,kℓ.e(g_0,g_0)^r^2·(u_i,k_ -u_j,k_ )^2=e(g_0,g_0)^d_ij,k_ . Because e(g0,g0)e(g_0,g_0) generates TG_T, exponents coincide mod p, yielding the stated equality. dij,kℓ=r2⋅(ui,kℓ−uj,kℓ)2modp.d_ij,k_ \;=\;r^2·(u_i,k_ -u_j,k_ )^2 p. The peer server verifies these commitments with the above test. The passing check guarantees that server k has performed the aggregation correctly. Once all checks pass, either server (at least one is assumed to be honest) computes the n−f−2n\!-\!f\!-\!2 smallest (scaled) pairwise distances for every client, sums them to obtain the Krum score, and selects the update with the minimal score as the next global model (using SCO and SF). Because the mask preserves distance ordering, the plaintext post-processing is identical to the classical Krum rule, while preserving privacy. 4.4.2 PRoVeFL-enabled Trimmed-Mean (Figure 5) Input: Each server k receives a set of n encrypted client updates ci,k=Enc(r⋅ui,k):i=1,2,…,n\c_i,k=Enc_ pk (r· u_i,k ):i=1,2,…,n\, where ui,ku_i,k is kthk^th subset of client update of client i. Server-Side Encrypted Operations. Encrypted operations 1. For every ordered pair (i,j)(i,j) the servers compute, Enc(dijk)=(ci,k−cj,k),∀j≠i.Enc_ pk (d_ij_k )=(c_i,k-c_j,k), ∀ j≠ i. Note that, Enc(dijk)=Enc(r⋅ui,k−r⋅uj,k).Enc_ pk (d_ij_k )=Enc_ pk (r· u_i,k-r· u_j,k ). 2. Collaborative decryption. Decrypt to obtain dijk=r⋅(ui,k−uj,k)d_ij_k=r·(u_i,k-u_j,k). Verification of Correct Computation. 3. Server publishes g0dij,klg_0^d_ij,k_l as a proof for correct computation (for every coordinate ℓ ). 4. Peer Server: For every coordinate ℓ and pair (i,j)(i,j) check, hikℓ⋅(hjkℓ)−1modp=?g0dij,klmodp.h_ik_ ·(h_jk_ )^-1 p ?=g_0^d_ij,k_l p. Plaintext operations 5. Coordinate-wise sorting: The sign of each coordinate of dijkd_ij_k represents the order of coordinates at that position in two updates. (a) From dijkd_ij_k, we can prepare a binary sign vector sgnsgn, such that sgnl=0,if ui,kl≤uj,kl1,otherwisesgn_l= cases0,&if u_i,k_l≤ u_j,k_l\\ 1,&otherwise cases. (b) Then, prepare a 1 vector containing 11 in each coordinate i.e. 1=(1,1,…,1)1=(1,1,…,1). (c) Create temporary vectors as below: Enc(tmp1)=sgn⋅Enc(ujk) _ pk (tmp_1 )=sgn·Enc_ pk (u_jk ) +(1−sgn)⋅Enc(uik) +(1-sgn)·Enc_ pk (u_ik ) Enc(tmp2)=sgn⋅Enc(uik) _ pk (tmp_2 )=sgn·Enc_ pk (u_ik ) +(1−sgn)Enc(ujk). +(1-sgn)\,Enc_ pk (u_jk )\,. (d) Enc(tmp1)Enc_ pk (tmp_1 ) and Enc(tmp2)Enc_ pk (tmp_2 ) are sorted vectors, so we can assign them back to Enc(uik)Enc_ pk (u_ik ) and Enc(ujk)Enc_ pk (u_jk ), respectively. This process repeats until the coordinates from all local model updates are sorted. 6. Trim extremes: This step is computed as for plaintext, pruning the top and bottom f updates. 7. Selection: FedAvg can be applied on the selected updates. Figure 5: Trimmed-Mean in PRoVeFL. Upon receiving the masked ciphertexts ci,k=Enc(rui,k)c_i,k=Enc_ pk(r\,u_i,k) for every client i, each server k homomorphically subtracts every ordered pair (i,j)(i,j) to obtain the encrypted coordinate-wise differences Enc(dij,k)=(ci,k−cj,k)Enc_ pk(d_ij,k)\!=\!(c_i,k-c_j,k), via PSE. A collaborative decryption then reveals only the obfuscated values dij,k=r(ui,k−uj,k)d_ij,k=r\,(u_i,k-u_j,k). For each coordinate ℓ , the honest peer checks the relation hi,kℓhj,kℓ−1≡g0dij,kℓ(modp)h_i,k_ h_j,k_ ^-1≡ g_0^d_ij,k_ p, thus ensuring the correctness of every difference without exposing plaintext updates. A binary sign vector derived from the decrypted dij,kd_ij,k guides a homomorphic rearrangement that sorts the encrypted coordinates in ascending order (SCO). Servers perform a secure compare-and-swap procedure, realised by Batcher’s odd-even mergesort network, on the ciphertexts. Batcher’s odd–even mergesort network executes a data‐independent sequence of (nlog2n)O(n ^2n) compare‐and‐swap operations, in contrast to the (n2)O(n^2) pairwise comparisons required by naive sorting. By integrating this network into Trimmed Mean, servers can efficiently perform coordinate-wise sorting over encrypted client updates, reducing the number of comparisons and overall computation compared to a fully quadratic approach. Once sorting is complete, the largest and smallest f values are discarded (SF), and the remaining n−2fn-2f entries per dimension are averaged. Because the random mask r preserves relative ordering, this plaintext post-processing exactly reproduces the classical The trimmed-mean rule, where all expensive computations, i.e., sorting, are done in the combined plaintext-ciphertext domain. 4.4.3 PRoVeFL-enabled FLTrust (Figure 6) Input: • Each server k receives a set of n encrypted client updates ci,k=Enc(r⋅ui,k):i=1,2,…,n\c_i,k=Enc_ pk (r· u_i,k ):i=1,2,…,n\, where ui,ku_i,k is kthk^th subset of client update of client i. • Additionally receives encrypted norm ei=Enc(r‖ui‖):i=1,2,…,n\e_i=Enc_ pk ( r\|u_i\| ):i=1,2,…,n\ [Note - It can also be calculated privately at the server side.] • Server Update Vector: u0,‖u0‖u_0,\|u_0\| Server-Side Encrypted Operations. 1. Coordinate-wise products. For each client i Enc(di)=u0⊙ci,k=Enc(r⋅ui,k⊙u0)Enc_ pk(d_i)\;=\;u_0 c_i,k=Enc_ pk(r· u_i,k u_0) 2. Collaborative decryption. Decrypt to obtain did_i Verification of Correct Computation. 3. Server Publishes g0dilg_0^d_i_l as a proof for the correct computation (for every coordinate ℓ ). 4. Peer Server: For every ℓ check hi,klutl=?gdil.h_i,k_l^u_t_l ?=g^d_i_l. 5. Abort on the first mismatch. Plaintext operations 6. Trust score. wi=max0,∑ℓ=1Ndi,ℓ‖u0‖.w_i= \0, _ =1^Nd_i, \|u_0\| \\;. 7. Scaled Updates Enc(uiscaled)=Enc(wi⋅‖u0‖ui‖⋅ui),Enc_ pk(u_i^scaled)=Enc_ pk (w_i· \|u_0\|\|u_i\|· u_i ), =(wi⋅‖u0‖)⋅Enc(1‖ui‖)⋅Enc(ui).= (w_i·\|u_0\| )·Enc_ pk ( 1\|u_i\| )·Enc_ pk(u_i). 8. Weighted Aggregation. Enc(ut+1)=1∑i=1nwi⋅∑i=1nEnc(uiscaled)Enc_ pk(u^t+1)= 1 _i=1^nw_i· _i=1^nEnc_ pk(u_i^scaled) Figure 6: FLTrust in PRoVeFL. Every server kS_k receives for each client i (i) a masked ciphertext share ci,k=Enc(r⋅ui,k)c_i,k=Enc_ pk(r· u_i,k) and (i) the encrypted reciprocal norm ei=Enc(‖ui‖−1)e_i=Enc_ pk\! (\|u_i\|^-1 ); the server itself holds the trusted reference vector u0u_0 and its norm ‖u0‖\|u_0\|. These computations rely on linear aggregation (LA). It first evaluates, under encryption, the coordinate-wise products Enc(di)=Enc(r⋅ui,k⊙u0)Enc_ pk(d_i)=Enc_ pk\! (r· u_i,k u_0 ). A threshold decryption reveals only the masked inner product vector di=r⋅ui,k⊙u0d_i=r· u_i,k u_0. For every coordinate ℓ the peer server verifies hi,kℓut,ℓ=?gdi,ℓh_i,k_ ^\,u_t, ?=g^d_i, ; failure of any check aborts the protocol, ensuring integrity via the discrete-log assumption. When all checks pass, the score vectors are concatenated to form di∈ℝNd_i ^N. Each server then computes the client’s FLTrust weight wi=max0,∑ℓ=1Ndi,ℓ/‖u0‖,w_i= \0, _ =1^Nd_i, /\|u_0\|\, a quantity still proportional to the true cosine similarity. Finally, the update is rescaled homomorphically (LA): Enc(uiscaled)=Enc(wi‖u0‖ui‖ui),Enc_ pk(u_i^scaled)=Enc_ pk\! (w_i\, \|u_0\|\|u_i\|\,u_i ), and the weighted average Enc(ut+1)=(∑iwi)−1∑iEnc(uiscaled)Enc_ pk(u^t+1)= ( _iw_i )^-1\! _iEnc_ pk\! (u_i^scaled ) is produced under encryption. 4.4.4 Enabling other aggregation schemes Beyond the three schemes instantiated above, PRoVeFL’s modular design extends naturally to a broad class of Byzantine-robust aggregation schemes. We observe that defenses such as MESAS [29], CrowdGuard [43], and FLAME [41] can be tailored to PRoVeFL. FLAME computes cosine similarity and performs clustering after that (LA, PSE). Further, it computes the Euclidean distance and finds the median for adaptive clipping (SCO). As discussed above, most of these statistical operations can be tailored to PRoVeFL. CrowdGuard also computes layer-wise Cosine and Euclidean distances, which we have already demonstrated with Krum and FLTrust. MESAS includes six statistical operations, including cosine similarity, Euclidean distance, count, variance, maximum, and minimum (PSE). Subsequently, it performs multiple clustering-based statistical tests to prune (LA, SF). Since MESAS covers the full set of statistical operations, we describe how to tailor it to PRoVeFL. Details can be referred to in A. 5 Security Analysis This section establishes that the proposed protocol guarantees confidentiality and integrity against both honest-but-curious and actively malicious aggregation servers. All reductions invoke the Decisional Ring–LWE assumption for ciphertext privacy and the hardness of the Discrete Logarithm Problem (DLP) in a prime-order group for commitment soundness. Throughout, let 1,2S_1,S_2 be the two aggregation servers, pk the public multi-key FHE key, and let kpre=ci,k,hi,kℓ,eii,ℓ view^pre_k\;=\; \\,c_i,k,\,h_i,k_ ,\,e_i \_i, denote the entire information set available to server kS_k before any homomorphic processing (ci,k=Enc(r⋅ui,k)c_i,k=Enc_ pk(r· u_i,k), hi,kℓ=gui,kℓh_i,k_ =g^u_i,k_ , and, if required, ei=Enc(‖ui‖−1)e_i=Enc_ pk(\|u_i\|^-1)). Let kpost=kpre∪di∣i∈[n] view^post_k\;=\; view^pre_k∪ \\,d_i i∈[n] \ be the information set after collaborative decryption, where did_i is either the masked pairwise‐distance vector (Krum), the masked coordinate difference vector (Trimmed‐Mean), or the masked inner‐product vector (FLTrust). Further, each server publishes a proof element gdi∈g^d_i and extends their local view to kproof=gdik∣i∈[n]. view^proof_k=\g^d_i_k i∈[n]\. Each peer server validates the published gdig^d_i against client commitments hi,kℓh_i,k_ using the method-specific equation: Krum:e(hi,kℓhj,kℓ−1,hi,kℓhj,kℓ−1)=?e(g,g)dij,kℓ.Krum:\;e\! (h_i,k_ h_j,k_ ^-1,h_i,k_ h_j,k_ ^-1 ) ?=e(g,g)^d_ij,k_ . Trimmed-Mean:hi,kℓhj,kℓ−1=?gdij,kℓ.Trimmed-Mean:\;h_i,k_ h_j,k_ ^-1 ?=g^d_ij,k_ . FLTrust:hi,kℓut,ℓ=?gdi,ℓ.FLTrust:\;h_i,k_ ^u_t, ?=g^d_i, . A single failure causes the honest server to withhold sharing a decrypted share, forcing an abort and preventing acceptance of the forged data. The sequence of Theorems 1 to 3 discussed in B to D uses the above views kpre view^pre_k, kpost view^post_k, and kproof view^proof_k to prove confidentiality and integrity for the entire protocol. 6 Evaluation In this section, we present a comprehensive evaluation of PRoVeFL, evaluating its computation, communication costs, robustness and verification cost analysis. 6.1 Experimental setup 6.1.1 Implementation All experiments are conducted on a system with Intel Xeon E5-4650 v4 @ 2.20 GHz with 112 logical CPUs, and 256 GB RAM. We implemented our framework in C++ using the Microsoft SEAL library111https://github.com/microsoft/SEAL for homomorphic encryption. Our code is available here222https://github.com/harshkasyap/provefl. For local model training, we used the PyTorch333https://github.com/pytorch/pytorch framework. We instantiated clients to run independently. Multi-key support and ciphertext packing are leveraged to maximize throughput. All results reported are averaged over 5 independent runs, unless specified otherwise. 6.1.2 Evaluation Goals Our evaluation seeks to answer the following key questions: Efficiency. What is the computational and communication overhead introduced by encrypted computation and partial decryption, to integrate state-of-the-art Byzantine robust schemes? How does PRoVeFL scale with increasing number of clients, servers, and model size? Breakdown. What is the breakdown of individual components in PRoVeFL? We chose to show this to demonstrate the time savings from offloading computations to plaintext. Byzantine Robustness. How well does the system perform (in terms of accuracy) in the presence of Byzantine clients under various poisoning attacks (Backdoor Attack, Trim Attack) and state-of-the-art Byzantine robust schemes tailored to PRoVeFL? Comparative Performance. How does PRoVeFL compare to prior secure FL systems such as ELSA [42], Prio [1, 10] and RoFL [6]? We chose these systems to compare with, since they cover single-server and distributed servers and can support at least a Byzantine-robust scheme (norm clipping). Verification Cost. We analsze the verification cost incurred by the server to validate that the aggregation has been performed correctly, assuming that at least one server is honest. 6.1.3 Parameters and Variations We vary the following system parameters to study performance under different settings: – Number of Clients (C): 10, 50, 100, 200. – Number of Servers (S): 2, 4, 10. – Dataset - Model Size (P): (1) 100k and 500k for Benchmarking; (2) 62k (CIFAR-10 S [30] - LeNet5 [31]); (3) 273k (CIFAR-10 L [30] - ResNet-18 [23]); (4) 818k (Shakespeare [7] - LSTM [24]) – Poisoning Attacks: Trim [13] and Backdoor [2] attacks. – Poisoning Client Fraction (A%): 10%, 20%, 40%. – Byzantine-Robust Aggregation Rules: L2L_2 norm (for comparison), Krum [5], Trimmed Mean [56], FLTrust [8]. – Baselines: ELSA [42], RoFL [6], Prio [10, 1]. – FHE polynomial modulus degree - 32768. 101050501001002002000112233# ClientsTime (s)L2 Norm2 servers4 servers10 servers 1010505010010020020002002004004006006008008001,0001,000# ClientsKrum 101050501001002002000100100200200300300400400# ClientsTrimmed Mean 10105050100100200200055101015152020# ClientsFLTrust Figure 7: Computation time vs. no. of clients (and servers) for different Byzantine-robust aggregation rules (100k params). 10105050100100200200011223344# ClientsTime (s)L2 Norm62k273k818k 1010505010010020020001,0001,0002,0002,000#ClientsKrum 101050501001002002000200200400400600600#ClientsTrimmed-Mean 10105050100100200200020204040#ClientsFLTrust Figure 8: Computation time vs. no. of clients (with 2 servers) for different Byzantine-robust aggregation rules across different model sizes (and datasets). 62k (CIFAR-10 S - LeNet5), 273k (CIFAR-10 L - ResNet-18), 818k (Shakespeare - LSTM). Table 2: Communication cost (in GB) vs. no. of clients with 2 servers (100k Params). # Clients L2L_2 norm Krum Trimmed-Mean FLTrust 10 0.005 0.110 0.061 0.026 50 0.005 3.220 0.824 0.132 100 0.005 13.030 2.257 0.263 200 0.005 26.180 5.924 0.527 Only L2L_2 norm values change with increasing number of servers. 0(P)010204087878888898990909191AdversariesAccuracy (%)Trim AttackKrumT-MeanFLTrust 0(P)010204087878888898990909191AdversariesBackdoor Attack Figure 9: Accuracy under Trim and Backdoor Attacks for different aggregation rules (CIFAR-10 L - ResNet-18). P: Plaintext, Rest: Encrypted and simulated with 2 servers. Table 3: Computation and Communication Cost (in MB) for Different Methods # Clients # Params Prio ELSA PRoVeFL (2 Servers) PRoVeFL (4 Servers) Client Server Client Server Client Server Client Server 50 100k 14.3 (59.1) 23.3 (0.002) 4.6 (51.6) 2.7 (640) 0.182 (9.8) 0.76 (5) 0.188 (10) 0.71 (2.5) 100 100k 14.8 (59.1) 48.9 (0.005) 7.1 (51.6) 3.8 (1280) 0.182 (10) 1.46 (5) 0.188 (10) 1.36 (2.5) 200 100k 16.5 (59.1) 99.5 (0.010) 8.4 (51.6) 6.1 (2560) 0.182 (10) 2.90 (5) 0.188 (10) 2.68 (2.5) 50 500k 63.6 (262.2) 102.9 (0.002) 17.5 (258.0) 11.2 (3200) 0.730 (20) 1.01 (10) 0.742 (20) 0.93 (10) 100 500k 67.7 (262.2) 218.4 (0.005) 23.2 (258.0) 17.3 (6400) 0.730 (20) 1.79 (10) 0.742 (20) 1.69 (10) 200 500k 78.3 (262.2) 457.9 (0.010) 38.0 (258.0) 31.4 (12800) 0.730 (20) 3.52 (10) 0.742 (20) 3.41 (10) Comparison of runtime (sec) and data sent (MB in parentheses; per client and per server) for relaxed L∞L_∞ defense. Table 4: Computation time (in seconds) and communication (in GB) for different model sizes (and datasets). #Params RoFL ELSA PRoVeFL Time Comm Time Comm Time Comm 62k 278 0.8 1.9 0.9 0.655 0.001 273k 2229 3.8 7.3 7.3 0.850 0.006 818k 4742 11.4 18.1 18.1 1.059 0.016 6.2 Results 6.2.1 Efficiency Figure 7 presents a comparative analysis of computation time across four Byzantine-robust aggregation rules: L2L_2 Norm, Krum, Trimmed Mean, and FLTrust, with varying numbers of clients (10, 50, 100, 200) and server counts (2, 4, 10). We observe that L2L_2 Norm exhibits the lowest and most stable computation time across all configurations, with only a modest increase as the client count grows, and minimal variation with server scaling. Krum incurs a high computational cost, especially with larger client counts, due to its pairwise distance computations. This cost is alleviated by increasing the number of servers. Trimmed Mean also benefits notably from increased server parallelism, suggesting good scalability. However, the costs of Krum and Trimmed Mean are inherently quadratic in the number of clients, since they compare all pairs of updates, whereas the costs of L2 norm and FLTrust are linear in the number of clients. Figure 8 demonstrates the server-side computation time as the number of clients increases across models of varying sizes (different datasets, two servers). The L2L_2 Norm method, being the simplest, exhibits linear scaling and remains computationally efficient even with 200 clients and large models. As noted earlier, Krum is significantly more expensive due to pairwise distance calculations, resulting in prohibitive delays for large-scale deployments. Trimmed-Mean offers an acceptable cost along with scalability. FLTrust maintains scalability similar to that of the L2L_2 Norm. The costs of Krum and Trimmed Mean are inherently quadratic in the number of clients, since they compare all pairs of updates, whereas the costs of L2L_2 norm and FLTrust are linear in the number of clients. Table 2 presents the communication cost (in GB) incurred under different Byzantine-robust aggregation rules as the number of clients increases, assuming two servers and a fixed model size of 100k parameters. L2L_2 norm shows a constant communication cost of 0.005 GB, regardless of the number of clients. This is because it requires only aggregated statistics to be shared with the servers, making it highly communication-efficient. Krum’s communication cost grows to over 26 GB for 200 clients because each client must exchange partial distance computations with all others. Trimmed-Mean scales more moderately than Krum, as it requires fewer exchanges, since we utilized the index pairs from Batcher’s odd-even mergesort network. FLTrust has a significantly lower cost than Krum and Trimmed-Mean. We refer to E for the runtime breakdown. 6.2.2 Byzantine Robustness Figure 9 demonstrates that all three aggregation rules (Krum, Trimmed-Mean, and FLTrust) maintain high accuracy even when clients’ updates are encrypted and subjected to increasing proportions of adversarial clients (performing Trim [13] and Backdoor [2] attacks). With no attack (both in plaintext and encrypted cases), each method achieves around 90% accuracy. As the adversarial fraction increases to 40%, the accuracy drop is minimal. These results confirm that, despite the added encryption overhead and targeted attacks, the robust aggregation schemes continue to behave as intended when implemented within PRoVeFL. 6.2.3 Comparative Performance Table 3 compares the computation time per client and per server (in seconds) and the communication cost (in MB) between different methods. We assume a relaxed L∞L_∞ defense for comparison, because ELSA does not support complex defenses, whereas Prio needs adjustments to run an L2L_2 norm defense as well. Prio incurs the highest overhead, with per-client costs exceeding 78s and 262MB for larger models (500k parameters), and server communication scaling linearly with the number of clients. ELSA improves client-side computation but suffers from excessive server communication and computation, particularly at larger scales (e.g., 31.4s and 12.5GB at 200 clients). PRoVeFL significantly reduces overhead for both clients and servers. In all configurations, client computation remains less than 1s, and communication cost is bounded (10–20MB), making it suitable for deployment even on edge devices. Server-side costs scale modestly with the number of clients and remain well within practical limits, while communication costs are held constant by efficient encrypted aggregation. Notably, using 4 servers instead of 2 further balances the load without increasing overall communication. These results demonstrate that PRoVeFL achieves scalability and practical efficiency, outperforming existing approaches. Table 4 evaluates how computation time and communication scale with increasing model size across RoFL, ELSA, and PRoVeFL. RoFL exhibits extremely high computation costs (up to 4742s) and communication overheads, making it impractical for large models. ELSA significantly reduces computation time compared to RoFL, but still incurs high communication costs that scale linearly with model size. In contrast, PRoVeFL maintains low and stable computation times, even for the largest model and drastically reduces communication overhead, up to 17 MB. This demonstrates that PRoVeFL is far more efficient and scalable than existing solutions, and also supports complex aggregation rules. 6.2.4 Verification Cost Analysis Let N be the full update dimension and n=N/2n=N/2 the number of coordinates held by each server. For every coordinate ℓ∈1,…,n ∈\1,…,n\, the honest peer checks the proof returned by the other server. Table 5 counts, per coordinate, the two dominant operations: • Exp: a modular exponentiation in the source group (G or TG_T); • Pair: a single evaluation of the bilinear pairing e:×→Te ×G _T. Table 5: Verification cost per coordinate (the honest peer performs the same test for all n=N/mn=N/m coordinates). Method # Exp / coordinate # Pair / coordinate Krum 11 (e(g,g)de(g,g)^d) 11 (e(⋅,⋅)e(·,·)) Trimmed-Mean 11 (gdg^d) 0 FLTrust 22 (hiut,gdh_i^u_t,\,g^d) 0 Aggregate cost Multiplying the per-coordinate counts by n yields the total work per round: Krum: n+n, n\, Exp+n\, Pair, Trimmed-Mean: n, n\, Exp, FLTrust: 2n. 2n\, Exp. Because a single pairing is typically an order of magnitude slower than a modular exponentiation, Krum incurs the highest overhead In all three cases, the verification effort scales linearly with the model dimension and is independent of the number of clients, ensuring scalability to high-dimensional updates. 6.2.5 Limitations PRoVeFL is compatible with a broad class of Byzantine-robust aggregation schemes, where relevant structural properties such as ordering, sign, or magnitude ratios are preserved under multiplicative masking and the operations can also be distributed among multiple servers to jointly calculate the final value. This holds for distance-based, similarity-based, and sorting-based operations. However, there do exist some aggregation schemes, such as Min-Max and Min-Sum [46], that apply non-linear transformations to client updates or rely on adaptive thresholds that are themselves functions of the unmasked data, and thus cannot be straightforwardly instantiated in PRoVeFL. 7 Conclusion This work presented a practically efficient and provably secure federated learning framework PRoVeFL based on multiparty key homomorphic encryption utilised by multiple servers. It is designed to address the challenges of data confidentiality and data aggregation integrity in the presence of malicious participants and servers. By distributing encrypted computation across multiple servers and introducing collaborative randomization to obfuscate sensitive intermediate values, PRoVeFL achieves scalability without compromising privacy. The framework supports different Byzantine-robust aggregation mechanisms, such as Krum, Trimmed Mean, FLTrust and MESAS directly on encrypted inputs, demonstrating resilience against both inference and poisoning attacks. The ability to efficiently integrate verification checks, traditionally impractical in pure FHE settings, further underscores the deployability of our solution. CRediT authorship contribution statement Harsh Kasyap, Anil Kumar Pradhan, and Ugur Ilker Atmaca are responsible for the design of the scheme, the experiment, and the writing of the paper. Graham Cormode and Carsten Maple are responsible for the design of the scheme and editing of the paper. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Data availability Public data has been used. Acknowledgment This work is supported, in part, by the UKRI Prosperity Partnership Scheme (FAIR) under the EPSRC Grant EP/V056883/1; EP/R007195/1 (Academic Centre of Excellence in Cyber Security Research - University of Warwick); EP/N510129/1 (The Alan Turing Institute); the Bill and Melinda Gates Foundation [INV-001309]. Under the grant conditions of the Foundation, a Creative Commons Attribution 4.0 Generic License has already been assigned to the Author Accepted Manuscript version that might arise from this submission. The author gratefully acknowledges the support provided by the Department of Science and Technology (DST), Government of India, through the INSPIRE Faculty Fellowship scheme. References [1] S. Addanki, K. Garbe, E. Jaffe, R. Ostrovsky, and A. Polychroniadou (2022) Prio+: privacy preserving aggregate statistics via boolean shares. In International Conference on Security and Cryptography for Networks, p. 516–539. Cited by: Table 1, §2.1.3, §6.1.2, §6.1.3. [2] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov (2020) How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, p. 2938–2948. Cited by: ¶2.1.1.1, §6.1.3, §6.2.2. [3] G. Baruch, M. Baruch, and Y. Goldberg (2019) A little is enough: circumventing defenses for distributed learning. Advances in Neural Information Processing Systems 32. Cited by: ¶2.1.1.1. [4] J. Bell, A. Gascón, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun (2023) ACORN: input validation for secure aggregation. In 32nd USENIX Security Symposium (USENIX Security 23), p. 4805–4822. Cited by: Table 1, §1. [5] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer (2017) Machine learning with adversaries: byzantine tolerant gradient descent. In Neural Information Processing Systems, p. 118–128. Cited by: §1.1, ¶2.1.2.1, §4.4, §6.1.3. [6] L. Burkhalter, H. Lycklama, A. Viand, N. Küchler, and A. Hithnawi (2021) Rofl: attestable robustness for secure federated learning. arXiv preprint arXiv:2107.03311 21. Cited by: Table 1, §2.1.3, §6.1.2, §6.1.3. [7] S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Konečnỳ, H. B. McMahan, V. Smith, and A. Talwalkar (2018) Leaf: a benchmark for federated settings. arXiv preprint arXiv:1812.01097. Cited by: §6.1.3. [8] X. Cao, M. Fang, J. Liu, and N. Gong (2021) FLTrust: byzantine-robust federated learning via trust bootstrapping. In NDSS, Cited by: §1.1, ¶2.1.2.3, §4.4, §6.1.3. [9] J. H. Cheon, A. Kim, M. Kim, and Y. Song (2017) Homomorphic encryption for arithmetic of approximate numbers. In Advances in cryptology–ASIACRYPT international conference on the theory and applications of cryptology and information security, p. 409–437. Cited by: §1. [10] H. Corrigan-Gibbs and D. Boneh (2017) Prio: private, robust, and scalable computation of aggregate statistics. In 14th USENIX symposium on networked systems design and implementation (NSDI 17), p. 259–282. Cited by: Table 1, §2.1.3, §6.1.2, §6.1.3. [11] A. I. C. Divisors (2017) Order-preserving encryption using approximate integer common divisors. In Data Privacy Management, Cryptocurrencies and Blockchain Technology: ESORICS International Workshops, p. 257. Cited by: §4.2.5. [12] W. Du, M. Li, L. Wu, Y. Han, T. Zhou, and X. Yang (2023) A efficient and robust privacy-preserving framework for cross-device federated learning. Complex & Intelligent Systems 9 (5), p. 4923–4937. Cited by: §1, §2.2. [13] M. Fang, X. Cao, J. Jia, and N. Gong (2020) Local model poisoning attacks to Byzantine-Robust federated learning. In 29th USENIX security symposium, p. 1605–1622. Cited by: §1, ¶2.1.1.1, §6.1.3, §6.2.2. [14] N. Franzese, A. Dziedzic, C. A. Choquette-Choo, M. R. Thomas, M. A. Kaleem, S. Rabanser, C. Fang, S. Jha, N. Papernot, and X. Wang (2023) Robust and actively secure serverless collaborative learning. Advances in Neural Information Processing Systems 36, p. 39504–39528. Cited by: §1.1, Table 1, §2.1.3. [15] M. Fredrikson, S. Jha, and T. Ristenpart (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In ACM SIGSAC conference on computer and communications security, p. 1322–1333. Cited by: ¶2.1.1.2. [16] C. Fu, X. Zhang, S. Ji, J. Chen, J. Wu, S. Guo, J. Zhou, A. X. Liu, and T. Wang (2022) Label inference attacks against vertical federated learning. In 31st USENIX security symposium, p. 1397–1414. Cited by: §1, §1. [17] K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov (2018) Property inference attacks on fully connected neural networks using permutation invariant representations. In ACM SIGSAC conference on computer and communications security, p. 619–633. Cited by: ¶2.1.1.2. [18] H. Gao, N. He, and T. Gao (2023) SVeriFL: successive verifiable federated learning with privacy-preserving. Information Sciences 622, p. 98–114. Cited by: §1. [19] J. Gao, B. Hou, X. Guo, Z. Liu, Y. Zhang, K. Chen, and J. Li (2021) Secure aggregation is insecure: category inference attack on federated learning. IEEE Transactions on Dependable and Secure Computing 20 (1), p. 147–160. Cited by: §1. [20] T. Gehlhar, F. Marx, T. Schneider, A. Suresh, T. Wehrle, and H. Yalame (2023) SafeFL: mpc-friendly framework for private and robust federated learning. In IEEE Security and Privacy Workshops (SPW), p. 69–76. Cited by: §1.1, Table 1, §2.1.3. [21] C. Gentry (2009) A fully homomorphic encryption scheme. Stanford university. Cited by: §1. [22] X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T. Baker (2020) V eri fl: communication-efficient and fast verifiable aggregation for federated learning. IEEE Transactions on Information Forensics and Security 16, p. 1736–1751. Cited by: ¶2.1.1.3. [23] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Computer vision and pattern recognition, p. 770–778. Cited by: §6.1.3. [24] S. Hochreiter and J. Schmidhuber (1997) Long short-term memory. Neural computation 9 (8), p. 1735–1780. Cited by: §6.1.3. [25] H. Hu, Z. Salcic, L. Sun, G. Dobbie, and X. Zhang (2021) Source inference attacks in federated learning. In International Conference on Data Mining (ICDM), p. 1102–1107. Cited by: §1. [26] Y. Huang, G. Yang, H. Zhou, H. Dai, D. Yuan, and S. Yu (2024) VPPFL: a verifiable privacy-preserving federated learning scheme against poisoning attacks. Computers & Security 136, p. 103562. Cited by: Table 1. [27] W. Jin, Y. Yao, S. Han, J. Gu, C. Joe-Wong, S. Ravi, S. Avestimehr, and C. He (2023) FedML-he: an efficient homomorphic-encryption-based privacy-preserving federated learning system. arXiv preprint arXiv:2303.10837. Cited by: §1. [28] H. Kasyap and S. Tripathy (2024) Sine: similarity is not enough for mitigating local model poisoning attacks in federated learning. Transactions on Dependable and Secure Computing 21 (5), p. 4481–4494. Cited by: §1. [29] T. Krauß and A. Dmitrienko (2023) Mesas: poisoning defense for federated learning resilient against adaptive attackers. In ACM SIGSAC Conference on Computer and Communications Security, p. 1526–1540. Cited by: §1.1, §4.4.4, §4.4. [30] A. Krizhevsky, G. Hinton, et al. (2009) Learning multiple layers of features from tiny images. Cited by: §6.1.3. [31] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, and L. D. Jackel (1989) Backpropagation applied to handwritten zip code recognition. Neural computation 1 (4), p. 541–551. Cited by: §6.1.3. [32] J. Liu, X. Li, X. Liu, H. Zhang, Y. Miao, and R. H. Deng (2024) DefendFL: a privacy-preserving federated learning scheme against poisoning attacks. IEEE Transactions on Neural Networks and Learning Systems. Cited by: Table 1. [33] S. Liu, J. Ren, R. Meng, X. Yan, Y. Miao, Z. Liu, J. Peng, Y. Zou, Z. Wang, H. Li, et al. (2025) Secure and robust federated learning under dual-server architecture in internet of things. IEEE Internet of Things Journal. Cited by: §2.1.3. [34] J. Ma, S. Naas, S. Sigg, and X. Lyu (2022) Privacy-preserving federated learning based on multi-key homomorphic encryption. International Journal of Intelligent Systems 37 (9), p. 5880–5901. Cited by: §1, §2.2. [35] R. Ma, K. Hwang, M. Li, and Y. Miao (2024) Trusted model aggregation with zero-knowledge proofs in federated learning. IEEE Transactions on Parallel and Distributed Systems. Cited by: Table 1. [36] D. Manna, H. Kasyap, and S. Tripathy (2022) Milsa: model interpretation based label sniffing attack in federated learning. In International conference on information systems security, p. 139–154. Cited by: §1. [37] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas (2017) Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, p. 1273–1282. Cited by: §1, §2.1. [38] H. B. McMahan, E. Moore, D. Ramage, and B. A. y Arcas (2016) Federated learning of deep networks using model averaging. CoRR abs/1602.05629. External Links: Link, 1602.05629 Cited by: §1, §2.1. [39] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava (2021) A survey on security and privacy of federated learning. Future Generation Computer Systems 115, p. 619–640. Cited by: §1. [40] M. Nasr, R. Shokri, and A. Houmansadr (2019) Comprehensive privacy analysis of deep learning: passive and active white-box inference attacks against centralized and federated learning. In IEEE symposium on security and privacy (SP), p. 739–753. Cited by: §1, ¶2.1.1.2. [41] T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. Möllering, H. Fereidooni, S. Marchal, M. Miettinen, A. Mirhoseini, S. Zeitouni, et al. (2022) FLAME: taming backdoors in federated learning. In 31st USENIX Security Symposium, p. 1415–1432. Cited by: §4.4.4. [42] M. Rathee, C. Shen, S. Wagh, and R. A. Popa (2023) Elsa: secure aggregation for federated learning with malicious actors. In Symposium on Security and Privacy (SP), p. 1961–1979. Cited by: §1.1, Table 1, §1, §6.1.2, §6.1.3. [43] P. Rieger, T. Krauß, M. Miettinen, A. Dmitrienko, and A. Sadeghi (2022) Crowdguard: federated backdoor detection in federated learning. arXiv preprint arXiv:2210.07714. Cited by: §4.4.4. [44] A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten (2022) Eiffel: ensuring integrity for federated learning. In ACM SIGSAC Conference on Computer and Communications Security, p. 2535–2549. Cited by: Table 1, §1. [45] A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein (2018) Poison frogs! targeted clean-label poisoning attacks on neural networks. In Neural Information Processing Systems, NIPS’18, p. 6106–6116. Cited by: ¶2.1.1.1. [46] V. Shejwalkar and A. Houmansadr (2021) Manipulating the byzantine: optimizing model poisoning attacks and defenses for federated learning. In NDSS, Cited by: ¶2.1.1.1, §6.2.5. [47] J. Tang, H. Xu, H. Liao, and Y. Zhou (2025) SeaFlame: communication-efficient secure aggregation for federated learning against malicious entities. IACR Transactions on Cryptographic Hardware and Embedded Systems 2025 (2), p. 69–93. Cited by: Table 1, §2.1.3. [48] J. Tang, H. Xu, M. Wang, T. Tang, C. Peng, and H. Liao (2024) A flexible and scalable malicious secure aggregation protocol for federated learning. IEEE Transactions on Information Forensics and Security. Cited by: Table 1. [49] Z. Tian, Y. Ding, X. Yu, E. Gong, J. Liu, and K. Ren (2025) Towards collaborative anti-money laundering among financial institutions. In Web Conference, p. 4722–4733. Cited by: §1. [50] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu (2020) Data poisoning attacks against federated learning systems. In 25th European symposium on research in computer security, p. 480–501. Cited by: §1. [51] R. Wang, X. Wang, H. Chen, J. Decouchant, S. Picek, N. Laoutaris, and K. Liang (2024) MUDGUARD: taming malicious majorities in federated learning using privacy-preserving byzantine-robust clustering. ACM Conference on Measurement and Analysis of Computing Systems 8 (3), p. 1–41. Cited by: §1.1, Table 1, §1, §2.1.3. [52] Z. Wang, Z. Chang, J. Hu, X. Pang, J. Du, Y. Chen, and K. Ren (2024) Breaking secure aggregation: label leakage from aggregated gradients in federated learning. In IEEE INFOCOM 2024-IEEE Conference on Computer Communications, p. 151–160. Cited by: ¶2.1.1.3. [53] G. Xu, H. Li, S. Liu, K. Yang, and X. Lin (2019) VerifyNet: secure and verifiable federated learning. IEEE Transactions on Information Forensics and Security 15, p. 911–926. Cited by: §1. [54] R. Xu, B. Li, C. Li, J. B. Joshi, S. Ma, and J. Li (2024) Tapfed: threshold secure aggregation for privacy-preserving federated learning. IEEE Transactions on Dependable and Secure Computing 21 (5), p. 4309–4323. Cited by: Table 1, §2.1.3. [55] B. Yin, H. Zhang, J. Lin, F. Kong, and L. Yu (2024) PVFL: verifiable federated learning and prediction with privacy-preserving. Computers & Security 139, p. 103700. Cited by: Table 1. [56] D. Yin, Y. Chen, R. Kannan, and P. Bartlett (2018) Byzantine-robust distributed learning: towards optimal statistical rates. In International Conference on Machine Learning, p. 5650–5659. Cited by: §1.1, ¶2.1.2.2, §4.4, §6.1.3. Appendix A PRoVeFL-enabled MESAS (Figure 10). MESAS is implemented under PRoVeFL by privately computing all statistical distances from perturbed client updates and performing the clustering and pruning in the plaintext domain. Each server privately computes the following operations on encrypted, randomly masked client updates: cosine similarity, Euclidean distance, count, min-max, and variance. After collaborative decryption, the servers obtain only obfuscated metric values, which preserve relative ordering. MESAS then applies its statistical tests to identify significant deviations, followed by clustering to separate benign and malicious client updates. Input: • Each server k receives a set of n encrypted client updates ci,k=Enc(r⋅ui,k):i=1,2,…,n\c_i,k=Enc_ pk (r· u_i,k ):i=1,2,…,n\, where uiku_ik is kthk^th subset of client update of client i. • Additionally receives encrypted norm and mean ei=Enc(r‖ui‖):i=1,2,…,n,Enc(r⋅μi).\e_i=Enc_ pk ( r\|u_i\| ):i=1,2,…,n\,Enc_ pk (r· _i ). [Note - Both encrypted norm and mean can also be calculated privately at the server side.] • Server Update Vector: u0,‖u0‖u_0,\|u_0\| Server-Side Encrypted Operations 1. Coordinate-wise products [Cosine Similarity]. For each client i Enc(cosi)=u0⊙ci,k‖u0‖⋅Enc(r‖ui‖)Enc_ pk(cos_i)\;=\; u_0 c_i,k\|u_0\|·Enc_ pk ( r\|u_i\| ) 2. Compute (Euclidean distance) Enc(euci)=(ci,k−u0,k)2.Enc_ pk (euc_i )=(c_i,k-u_0,k)^2. 3. Find (Pairwise distance - Min/Max/COUNT) Enc(counti)=(ci,k−u0,k).Enc_ pk (count_i )=(c_i,k-u_0,k). 4. Calculate (Variance) Enc(vari)=(ci,k−r⋅μi).Enc_ pk (var_i )=(c_i,k-r· _i). 5. Collaborative decryption. Decrypt to obtain cosicos_i, eucieuc_i, counticount_i, varivar_i. Verification of Correct Computation. 6. Servers publish e(g0,g0)dij,kle(g_0,g_0)^d_ij,k_l as a proof for the correct computation, for all di∈cosid_i∈\cos_i, eucieuc_i, counticount_i, varivar_i\. 7. Peer Servers: For every coordinate ℓ and pair (i,j)(i,j) verify, e(hikℓ(hjkℓ)−1,hikℓ(hjkℓ)−1)=?e(g0,g0)dij,kl.e(h_ik_ (h_jk_ )^-1,h_ik_ (h_jk_ )^-1) ?=e(g_0,g_0)^d_ij,k_l. 8. Abort on the first mismatch. Plaintext operations 9. Euclidean and cosine distances: Now, one of the servers (assuming at least one is honest) compute the total Euclidean and cosine distance. The distances are scaled up by r. However, they preserve order, which is sufficient. 10. Min/Max/COUNT: From all the decrypted count vectors, Min and Max can be calculated. Further, we can prepare a binary sign vector sgnsgn, such that sgnl=0,if ui,kl≤u0,kl1,otherwisesgn_l= cases0,&if u_i,k_l≤ u_0,k_l\\ 1,&otherwise cases. Sum of sgn gives COUNT that how many parameter values have increased from the respective parameter of the previous global model. 11. Selection: This step can be computed same as in plaintext, perform pruning based on clustering, and selecting the next global model update. Figure 10: Instantiation of MESAS in PRoVeFL Appendix B Input-Phase Confidentiality Theorem 1. The pre-processing view kpre view^pre_k held by any single PPT server is computationally indistinguishable from a view with uniformly random ciphertexts. Consequently, the server learns nothing about individual client updates beyond public-size metadata. Proof. IND-CPA security (decisional Ring-LWE) makes (ci,1,ci,2)(c_i,1,c_i,2) indistinguishable from encryptions of uniform vectors. Commitments hi,kℓ=gui,kℓh_i,k_ =g^u_i,k_ reveal no message information under DLP hardness. A simulator that replaces each ciphertext by an encryption of a uniform vector produces a view that is indistinguishable from the real execution, establishing the claim. ∎ Appendix C Post-Decryption Privacy Theorem 2. For any probabilistic polynomial-time adversary controlling a single server, the distribution of di\d_i\ is computationally indistinguishable from uniform; the adversary therefore gains no non-negligible information about the underlying plaintext updates beyond the masked vectors did_i. Proof. The global mask r←$ℤp×r ←Z_p^× is from a uniform distribution and remains secret from every individual server. Fix an arbitrary probabilistic polynomial-time adversary A that corrupts 1S_1 and let 1post view^post_1 denote the adversary’s entire view, including the set dii=1n\d_i\_i=1^n obtained after collaborative decryption. Hybrid argument. We build a sequence of hybrids ℋ0,ℋ1H_0,H_1 and show that A cannot distinguish them. ℋ0H_0 The real execution outputting the true masked statistics did_i computed as specified below. ℋ1H_1 Identical to ℋ0H_0 except that the simulator samples a fresh r′←$ℤp×r ←Z_p^× independent of all protocol messages and replaces every did_i by di′←f(r′,si)d_i ← f(r ,s_i), where the masking function f is chosen per aggregation rule: f(r′,si)=r′2siKrumr′siTrimmed-Meanr′ut⊙ui,kFLTrust.f(r ,s_i)= casesr 2\,s_i&Krum\\[4.0pt] r \,s_i&Trimmed-Mean\\[4.0pt] r \,u_t u_i,k&FLTrust. cases Indistinguishability of hybrids. For each rule we argue that 1post(ℋ0) view^post_1(H_0) and 1post(ℋ1) view^post_1(H_1) are computationally indistinguishable: Krum. Coordinates take the form dij,kj=r2Δij,kj2d_ij,k_j=r^2\, _ij,k_j^2 with Δij,kj≠0 _ij,k_j≠ 0 except with negligible probability. Because r is uniform non-zero, r2r^2 is uniform over the quadratic residues modulo p. The set of squares forms a subgroup of index 2, whence r2Δ2r^2\, ^2 is uniform over the same subgroup in both hybrids; the distributions coincide. Trimmed-Mean. For any fixed non-zero coordinate si,j=ui,kj−uj,kjs_i,j=u_i,k_j-u_j,k_j, the product rsi,jr\,s_i,j is uniform in ℤpZ_p because r is uniform in ℤp×Z_p^×. When si,j=0s_i,j=0 the value is identically 0 in both hybrids, which occurs with probability 1/p1/p and is therefore negligible. Thus every coordinate of did_i is identically distributed in the two hybrids. FLTrust. Each coordinate is di,j=rut,jui,kjd_i,j=r\,u_t,j\,u_i,k_j. The known constant ut,ju_t,j is non-zero with overwhelming probability, so rut,jr\,u_t,j is again uniform over ℤp×Z_p^×. Multiplying by ui,kju_i,k_j therefore yields a uniform coordinate unless ui,kj=0u_i,k_j=0, which happens with negligible probability. Simulation. In ℋ1H_1 the simulator need not know the plaintext updates: it draws r′r and outputs independent random vectors of the correct dimensionality. Therefore ℋ1H_1 can be generated without access to any client secret, and A’s distinguishing advantage between ℋ0H_0 and ℋ1H_1 is negligible. Conclusion. Since ℋ1H_1 is independent of the underlying plaintext updates, the adversary extracts no non-negligible information from di\d_i\. ∎ Appendix D Aggregation integrity 00.10.10.20.20.30.30.40.40.50.50.60.60.70.70.80.80.90.91110S4S2STime (s)ClientsL2L_2 normClientServer-EncServer-Plain 01122334455667788991010111110S4S2STime (s)Krum 010102020303040405050606010S4S2STime (s)ClientsTrimmed Mean 00.50.5111.51.5222.52.5333.53.5444.54.55510S4S2STime (s)FLTrust Figure 11: Runtime breakdown across different Byzantine-robust aggregation methods and servers (50 clients, 100k params). 00.20.20.40.40.60.60.80.8111.21.21.41.41.61.61.81.810S4S2STime (s)ClientsL2L_2 normClientServer-EncServer-Plain 0202040406060808010010012012014014016016018018010S4S2STime (s)Krum 0202040406060808010010012012014014016016010S4S2STime (s)ClientsTrimmed Mean 0112233445566778899101010S4S2STime (s)FLTrust Figure 12: Runtime breakdown across different Byzantine-robust aggregation methods and server (100 clients, 100k params). Theorem 3. Any probabilistic polynomial-time (PPT) adversary A that corrupts a single aggregation server, can convince the honest server to accept an aggregate vector di,jk′≠di,jkd _i,j_k≠ d_i,j_k (where di,jkd_i,j_k is the actual computed intermediate aggregation vector Krum, Trimmed-Mean, or FLTrust as applicable) only with negligible probability. Proof. Assume a PPT adversary A controls server 1S_1 and causes the honest server 2S_2 to accept an incorrect vector d′≠d ≠ d with non-negligible probability ε(λ) (λ). We build a reduction ℬB breaking the discrete logarithm (DL) problem in G. Hybrid embedding. Given a DL instance (g0,g0x)(g_0,g_0^x), ℬB selects a random coordinate ℓ⋆ , embeds g0xg_0^x into the proof element that 1S_1 must output for that coordinate, and generates all other protocol values honestly. Specifically, the expected proof in each method is replaced as follows: Rule Correct proof for coord. ℓ⋆ Challenge Krum e(g0,g0)dℓ⋆e(g_0,g_0)^d_ e(g0,g0)xe(g_0,g_0)^x Trimmed-Mean g0dℓ⋆g_0^d_ g0xg_0^x FLTrust g0dℓ⋆g_0^d_ g0xg_0^x Forgery implies DL solution. If A forges a vector d′d that differs from d in ℓ⋆ yet passes the verification test, the following relations hold: Krum: e(hihj−1,hihj−1)=e(g0,g0)x, e(h_ih_j^-1,h_ih_j^-1)=e(g_0,g_0)^x, Trimmed: hihj−1=g0x, h_ih_j^-1=g_0^x, FLTrust: hiut,ℓ⋆=g0x, h_i^u_t, =g_0^x, where hi=gui,ℓ⋆=g0rui,ℓ⋆h_i=g^u_i, =g_0^ru_i, . Bilinearity (or plain exponent algebra) yields x=r2Δ2KrumrΔTrimmed-Meanrut,ℓ⋆FLTrust,x= casesr^2 ^2&Krum\\ r &Trimmed-Mean\\ r\,u_t, &FLTrust, cases with Δ=ui,ℓ⋆−uj,ℓ⋆≠0 =u_i, -u_j, ≠ 0 except with probability 1/p1/p. Because Δ and ut,ℓ⋆u_t, are non-zero and publicly known, ℬB inverts the multiplicative constant and outputs x, solving DL whenever the forgery occurs. Extraction via the decrypted value did_i. After the collaborative decryption step each intermediate statistic dij,kℓd_ij,k_ is revealed to both servers in plaintext form. Hence the reduction ℬB can read the forged entry dij,kℓ⋆′d _ij,k_ directly. From the verification equation that A caused to hold we obtain, for the special coordinate ℓ⋆ , x=dij,kℓ⋆′Krum, since dij,kℓ⋆′=r2Δ2,dij,kℓ⋆′Trimmed-Mean, where dij,kℓ⋆′=rΔ,di,ℓ⋆′ut,ℓ⋆FLTrust, with di,ℓ⋆′=rut,ℓ⋆.x= casesd _ij,k_ &Krum, since d _ij,k_ =r^2 ^2,\\[4.0pt] d _ij,k_ &Trimmed-Mean, where d _ij,k_ =r ,\\[4.0pt] d _i, u_t, &FLTrust, with d _i, =r\,u_t, . cases Here Δ=ui,ℓ⋆−uj,ℓ⋆≠0 =u_i, -u_j, ≠ 0 except with probability 1/p1/p. Because r is uniform in ℤp×Z_p^× and never revealed, dij,kℓ⋆′d _ij,k_ is a non-zero multiple of x chosen uniformly at random, and the multiplier (r2Δ2r^2 ^2, rΔr , or rut,ℓ⋆r\,u_t, ) is invertible with overwhelming probability. ℬB therefore recovers x by a single modular division, solving the discrete-log instance whenever the forgery occurs. Success probability. The reduction fails only when the chosen coordinate is Δ=0 =0 (or ut,ℓ⋆=0u_t, =0 for FLTrust), an event of probability at most 1/p1/p. Thus ℬB solves the DL with probability at least ε(λ)/N−negl(λ) (λ)/N-negl(λ), contradicting DL hardness. Consequently, a corrupt server can cause acceptance of dij,k′≠dij,kd _ij,k≠ d_ij,k only with negligible probability. ∎ Appendix E Runtime Breakdown Figures 11 and 12 present a runtime breakdown of server (Plaintext vs. Encrypted) and client in PRoVeFL-tailored schemes, with different numbers of server (2, 4 and 10) and client (50 and 100 clients). Each bar is divided into three components: (i) Client computation, (i) Encrypted server-side computation, and (i) Plaintext (or Plaintext-Ciphertext) server-side computation. Client Computation is consistently lightweight. For all aggregation methods and client counts, the client-side computation remains at 0.18s with 2 servers. It is 0.25s for 10 servers, because the client needs to encrypt more packets. Overall, the client-side overhead does not scale significantly with the number of clients or the choice of aggregation. For 100 clients, Krum requires more than 100s on the server, indicating a drastic increase in encrypted computation due to its pairwise distance computations. For Trimmed-mean, encrypted computation time increases with the number of clients, rising from 14s (50 clients) to 161s (100 clients), because the number of pairwise comparisons increases. However, Trimmed-mean improves by big margins after increasing the number of servers. FLTrust shows moderate runtime overheads under encryption and remains efficient even with 100 clients.