PaperlayerView exact revision on arXiv

Source-linked AI summary

Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning

Xinyun Liu, Zhi Lu, Yu Chen, Ronghua Xu

arXiv:2608.20580v1cs.CRcs.LG

TL;DR

Federated learning defenses often separate data provenance from gradient-security protection, leaving a gap in joint protection against multi-level attacks. This paper combines keyed PAM watermarking with FMGAN and lattice-based zero-knowledge secure aggregation, reporting robust mitigation of composite cross-layer threats while jointly verifying both layers. The approach nevertheless retains scope boundaries involving indirect physical anchoring and potential watermark replay.

  • Problem

    Existing FL defense mechanisms address data-layer provenance or gradient-aggregation security separately rather than through a joint verification workflow.

  • Method

    The framework derives PAM from trusted time, location, and server context, applies keyed HMAC-SHA256, embeds the payload with FMGAN, and verifies committed gradients using LZKSA.

  • Results

    The joint pipeline robustly mitigates composite threats including dataset substitution, forged data injection, gradient scaling, and protocol abuse.

  • Takeaways & Limitations

    The evaluations support complementary data-authenticity and computation-integrity protection within an end-to-end trustworthy FL framework.

  • Takeaways & Limitations

    The watermark uses an indirect soft link to the physical anchor, lacks intrinsic content binding, and cannot independently prevent replay-based watermark forgery.

Abstract

from arXiv · show

Federated learning (FL) is vulnerable to multi-level attacks. However, existing methods address them separately, leaving FL exposed to data leakage, unauthorized reuse, and malicious gradient manipulation. In this work, we propose an FL framework that couples keyed context-provenance watermarking with verifiable lattice-based secure aggregation of Real-World Anchored Watermarking and Lattice-Based Zero-Knowledge Secure Aggregation. At the data layer, we propose a Kerckhoffs-compliant scheme that utilizes Physical Anchor Metadata (PAM) to ensure data provenance. PAM is defined as a context-provenance token derived from trusted infrastructure data (time, location, and server ID) and then subjected to a keyed HMAC-SHA-256 transformation to produce a watermark payload that cannot be generated without the client's secret key. We further design FMGAN, a GAN-based robust image watermarking framework that embeds this transformed payload using a feature fusion module and a Mamba-guided linear attention mechanism. At the computation layer, we adopt a lattice-based zero-knowledge secure aggregation (LZKSA) protocol that verifies key correctness, L2 norm bounds, and cosine similarity constraints over committed gradients without revealing private updates. The RLWE-based design guarantees post-quantum security. Extensive experiments validate the complementary protection of the two layers under composite attack scenarios. To our knowledge, no prior verification workflow has jointly evaluated both layers in a hybrid, end-to-end trustworthy FL framework.

I. INTRODUCTION

Existing federated-learning defenses typically protect either data provenance or gradient aggregation, leaving multi-level attack surfaces insufficiently addressed. The paper proposes a dual-layer framework combining keyed PAM watermarking, FMGAN, and lattice-based zero-knowledge aggregation.

  • Existing FL defenses address data-layer provenance or gradient-aggregation security in isolation, leaving leakage, unauthorized dataset usage, and malicious model manipulation exposed.
  • The framework introduces a Kerckhoffs-compliant watermarking scheme that transforms Physical Anchor Metadata into keyed cryptographic payloads.PAM-derived payloads are designed to be infeasible to generate without the client’s secret key.
  • The authors present the framework as the first joint verification workflow integrating data-security watermarking with lattice-based zero-knowledge secure aggregation.
  • FMGAN embeds PAM-derived watermarks using feature fusion and Mamba-guided linear attention in a GAN-based image-watermarking framework.
  • The computation layer integrates lattice-based zero-knowledge secure aggregation into practical FL workflows while preserving verification guarantees and reducing system complexity.
  • The complete pipeline is evaluated end to end for robustness against dataset leakage, unauthorized dataset usage, and gradient manipulation.The evaluation highlights complementary protection from PAM watermarking and lattice-based secure aggregation.

A. Image Authentication and Watermarking

Image authentication uses active methods such as watermarking to bind verifiable data to media, while FL secure aggregation protects update confidentiality but does not by itself validate update integrity. The paper positions these techniques within a broader provenance and computation-security context.

  • Active image-authentication techniques embed verifiable data into spatial or frequency domains, including cryptography, digital signatures, and watermarking.
  • Robust watermarking binds information to media payloads, supporting tamper detection and asset attribution even when external metadata is stripped.
  • GAN-based watermarking methods have demonstrated improved robustness, invisibility, and adaptability over traditional CNN-based techniques.Adversarial training helps produce visually indistinguishable watermarked images resilient to varied distortions.
  • ENF fluctuations provide spatio-temporal traces that can support multimedia authentication and tamper detection.
  • Secure aggregation lets servers observe only aggregated client updates, but it cannot prevent clients from submitting malformed or adversarial updates.
  • The proposed FL setting combines private client datasets and on-device updates with a dual-layer architecture targeting data authenticity and computation integrity.

C. Threat Model

The threat model targets data authenticity and computation integrity across a distributed FL pipeline. The proposed design links trusted physical context to keyed watermarks and verifies extracted provenance during image authentication.

  • The attacker may know the watermarking architecture, embedding and extraction procedures, and public parameters, but not the private HMAC-driving key.Key generation and distribution are assumed secure.
  • The framework separates data-security protection for local training data from computation-security protection for aggregated model updates.
  • The physical anchor fabric generates verifiable PAMs from trusted ground-truth references and supports their generation and verification.
  • PAM combines time, location, ENF server ID, and error-correction information into a context-provenance representation sourced from trusted infrastructure.
  • The keyed watermark is produced through HMAC-SHA256 and embedded into images by FMGAN, preventing forgery without the client secret key.
  • Verification extracts the watermark and metadata, then accepts the asserted context only when the keyed PAM recomputation matches the extracted watermark.A positive result certifies a key-valid context-provenance token, not that the image content itself is genuine.

B. The Watermarking Model

FMGAN’s encoder combines feature fusion with Mamba-guided linear attention to embed watermarks while balancing image quality, robustness, and computational efficiency.

  • Encoder architecture: FMGAN’s encoder comprises a Feature-Fusion Module and a Mamba-Guided Linear Attention Module.The FFM extracts shallow and deep features through dense blocks, while MGLA guides watermark placement.
  • Feature fusion: The FFM combines shallow and deep features across layers using dense blocks with BN, ReLU, and convolutional layers.Dense connections promote feature reuse and improve the encoder’s representation capability.
  • MGLA design: MGLA replaces Mamba’s recurrent forget gate with parallelizable positional encodings and integrates depth-wise convolutions and gating into linear attention.This design preserves positional awareness while enabling parallel computation and efficient feature extraction.
  • Efficiency: MGLA achieves efficient global modeling with linear complexity O(N) and fully parallelizable computation.Its complexity terms correspond to projections, linear attention, depth-wise convolution, and MLP operations.
  • Adaptive watermark placement: MGLA adaptively reweights spatial regions to modulate watermark strength and balance imperceptibility with robustness.The attention mask is generated from global cover-image features and applied to fused representations before residual encoding.
  • Training objective: The encoder’s loss combines mean-square reconstruction error and structural similarity to reduce visual discrepancy between cover and encoded images.The coefficients ϵ1 and ϵ2 weight the reconstruction and visual losses, respectively.

2) Decoder for Watermark Retrieval:

The decoder is trained with differentiable noise and feedback from watermark extraction, enabling recovery of the embedded watermark from distorted images without the original image.

  • Noise-aware training: The noise module applies differentiable distortions during training to improve watermarking robustness.Noised features are generated as Fnoise = Noise(Fen, Ntrain).
  • Watermark retrieval: The decoder extracts the watermark from noised features as Wout = Dβ(Fnoise).Training minimizes the discrepancy between extracted Wout and original Win with respect to decoder parameters β.
  • Robustness feedback: Decoder feedback guides the encoder away from fragile feature regions during noise-aware training.This collaborative optimization supports watermark recovery without requiring access to the original image.

3) Discriminator:

The discriminator promotes inconspicuous and resilient watermarking, while LZKSA verifies masked gradients and norm or similarity constraints through RLWE-based commitments.

  • Discriminator: The discriminator distinguishes cover images from watermarked images and trains the encoder to make watermarked outputs harder to classify as fake.This adversarial loop supports inconspicuous and resilient embeddings against perceptual attacks.
  • Secure aggregation verification: LZKSA uses RLWE-based public-coin Σ-protocols to prove committed-input consistency and L∞-, L2-, and cosine-similarity constraints.The protocol avoids reducing each constraint to a generic zero-knowledge circuit.
  • RLWE commitments: The aggregation ciphertext is reused as the RLWE commitment, which is computationally hiding and binding under RLWE.This avoids a separate commitment layer.
  • Verification workflow: Algorithm 1 returns Accept only after verifying key, L∞, L2, and cosine proofs, then aggregates the accepted ciphertext.Failed verification causes rejection.
  • Mask verification: LZKSA proves global mask cancellation and pairwise mask consistency, allowing inconsistent clients to be identified.The pairwise check provides information unavailable from global cancellation alone.
  • Constraint proofs: The verifier checks bounded coefficients, squared L2 norms, and cosine thresholds using specialized commitments and consistency equations.The cosine constraint is reduced to a bounded scalar comparison against a public reference vector.

D. Cross-Layer Security Complementarity

The keyed PAM watermarking and LZKSA layers protect distinct, complementary parts of federated learning: data assets and gradient aggregation.

  • Data layer: PAM watermarking mitigates dataset leakage, data theft, and unauthorized reuse of sensitive images.Its protection targets the data layer of the federated learning pipeline.
  • Computation layer: LZKSA defends against malicious gradient manipulation and poisoning during optimization.Its protection targets the computation and aggregation layer.

V. EXPERIMENTAL RESULTS

The experiments evaluate the dual-layer framework at component and system levels in a simulated federated learning environment. Metrics cover watermark imperceptibility, extraction robustness, secure-aggregation verification, and composite attacks.

  • Evaluation Scope: The evaluation combines component-level watermarking and LZKSA analysis with system-level testing under composite attack scenarios.The component analysis covers watermark imperceptibility and robustness alongside LZKSA correctness and efficiency.
  • Implementation: The simulated FL environment uses private client datasets, masked gradients, and server-side LZKSA secure aggregation.Watermarking experiments use PyTorch on an NVIDIA Tesla V100 with COCO, ImageNet-10, and FFHQ images resized to 512 × 512 × 3.
  • Metrics: PSNR and SSIM measure watermark imperceptibility, while Bit Accuracy measures extraction robustness.SA is the baseline; ZK∞, ZK2, and ZKcos denote zero-knowledge bounds for update norms and cosine similarity.
  • Evaluation Scope: Table I compares different watermarking models on the COCO dataset.The table is part of the watermarking evaluation setup.

B. Component-Level Evaluation

FMGAN is evaluated for imperceptibility, robustness, generalization, and resistance to watermark removal. Results report strong fidelity and extraction performance, while removal attacks substantially reduce detection and bit accuracy but introduce visible artifacts.

  • Watermark Invisibility: 41.59 dB PSNR and 0.9902 SSIM are achieved by FMGAN at a 64-bit payload on 1,000 COCO images.The keyed design limits keyless forgery probability per trial to 2^-w, and HMAC-SHA256 adds 0.01 ms overhead.
  • Watermark Invisibility: Attention masks place stronger watermark signals in texture-rich regions, keeping watermarked images perceptually indistinguishable from originals.Figure 5 presents original images, attention masks, and watermarked images.
  • Watermark Robustness: 96.37% BA under Gaussian noise with σ2 = 0.10 and a 20.77% advantage under JPEG QF = 10 demonstrate FMGAN’s robustness over HiDDeN.The model also remains robust to color and geometric distortions when the payload is scaled to 64 bits.
  • Comparison With SOTA Models: FMGAN consistently outperforms competing SOTA watermarking methods in image quality and robustness on COCO.The cited passage also states that cross-dataset generalization is evaluated on ImageNet-10.
  • Watermark Removal Attack: TPR@1%FPR falls from 1.00 to 0.02 and average Bit Accuracy from 1.00 to 0.43 after a state-of-the-art watermark removal attack.The regenerated images retain primary structures but contain perceptible fine-grained background inconsistencies.

2) Evaluation of Secure Aggregation:

The secure-aggregation evaluation measures LZKSA across datasets ranging from 19k to 11181k parameters and under composite threats. Verification adds limited client and server overhead while supporting detection of dataset replacement and gradient scaling.

  • Efficiency Evaluation: Figure 7 compares LZKSA with standard SA for five datasets and 50 clients across parameter sizes from 19k to 11181k.Both per-client and server-side computation times are reported.
  • Efficiency Evaluation: Below 0.2 seconds, client-side verification time remains reported for 19k and 62k datasets across key and data-validation protocols.The passage characterizes this overhead as insignificant compared with overall SA execution time.
  • Efficiency Evaluation: Server-side verification time grows linearly with user size, with ZKcos incurring the largest overhead because it verifies all clients using more complex arithmetic.Even at 11181k, the reported server-side verification time remains within an acceptable range.
  • Efficiency Evaluation: The experiments conclude that LZKSA provides scalable input verification with minimal client and server computational overhead.The stated conclusion is that added security guarantees do not sacrifice FL practicality in large-scale, high-dimensional settings.
  • Composite Attack Evaluation: The system-level evaluation targets composite attacks that jointly exploit data manipulation, gradient tampering, and cryptographic protocol abuse.One modeled attack combines unauthorized data replacement with an abnormally large-magnitude uploaded gradient.
  • Composite Attack Evaluation: 100% detection accuracy with zero false positives is reported for 10% dataset replacement, while gradient scaling is checked with ZK∞ and ZK2 bounds.Among tested scaling limits, B = 1.5 is identified as the optimal security-utility trade-off.

2) Attack II: Forged Data Injection and Directional Gradient Manipulation:

Attack II combines forged-data injection with directional gradient manipulation, while a further evaluation tests watermark suppression and malformed aggregation behavior. The framework reports perfect forged-data detection, tuned cosine-threshold filtering, robust watermark extraction, and negligible proof-bypass probability.

  • Detection Results: 100% detection with zero false positives is reported for forged-data injection, while α = 0.8 balances cosine-based anomaly filtering and update utility.The cosine constraint compares the input gradient x with median benchmark y using threshold α.
  • Aggregation Integrity: Malformed encrypted gradients, replay attacks, and invalid zero-knowledge proofs are rejected when the verification equation does not match.The stated success probability under the RLWE assumption is negligible in the security parameter.
  • Watermark Suppression: FMGAN achieves the highest BA across crop, dropout, blur, resize, and JPEG distortion intensities in the watermark-suppression evaluation.FMGAN and FMGAN-NN outperform their HiDDeN counterparts under cropping and dropout, while FMGAN remains strong under Gaussian blur.
  • Utility Evaluation: The utility evaluation reports test accuracy for watermarking and each private-validation component on the original FL task.Table VIII defines the watermark column as accuracy with watermark-trained images and the remaining columns as accuracy after private validation.
  • Watermark Suppression: Noise-aware training improves BA for both FMGAN and HiDDeN, while feature fusion preserves stable extraction for FMGAN-NN without explicit noise-aware training.The comparison is made against the corresponding NN variants.

4) Utility Impact on the Original FL Task:

The dual-layer framework preserves original federated-learning utility while retaining validation-based robustness under attack, with small benign-case accuracy costs and identified scope limitations.

  • Watermarking utility: 83.6% accuracy with watermarked images was only 0.2 percentage points below the 83.8% clean baseline.The result indicates that FMGAN embedding preserves downstream training performance.
  • Secure aggregation utility: 0.2 percentage points on MNIST-0.5 and 0.4 percentage points on CIFAR-10 quantify the Full scheme’s benign accuracy changes.The reported gap mainly stems from fixed-point representation and excluding updates that fail public validation parameters.
  • Robustness under attack: 80.1% accuracy under CIFAR-10 Trim attack with ZK2, ZK∞, and ZKcos recovered performance from 19.5% without validation.ZK2 and ZK∞ control update magnitude, while ZKcos adds directional consistency against a public cosine-similarity threshold.
  • System-level evaluation: System evaluations report mitigation of composite cross-layer threats without sacrificing aggregation accuracy or watermark extractability.The evaluated threats include dataset replacement, forged data injection, noise perturbations, and protocol abuse.
  • Limitations and future work: The watermarking evaluation primarily covers common distortions and noise, while adaptive removal attacks and non-image modalities remain future work.The stated future scope includes optimization- or learning-based attacks and text, audio, or multimodal federated learning.
Loading 2608.20580v1…