PaperlayerView exact revision on arXiv

Source-linked AI summary

Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning

Xinyun Liu, Zhi Lu, Yu Chen, Ronghua Xu

arXiv:2608.20580v1cs.CRcs.LG

TL;DR

Federated learning defenses often separate data provenance from gradient-security protection, leaving a gap in joint protection against multi-level attacks. This paper combines keyed PAM watermarking with FMGAN and lattice-based zero-knowledge secure aggregation, reporting robust mitigation of composite cross-layer threats while jointly verifying both layers. The approach nevertheless retains scope boundaries involving indirect physical anchoring and potential watermark replay.

Abstract

from arXiv · show

Federated learning (FL) is vulnerable to multi-level attacks. However, existing methods address them separately, leaving FL exposed to data leakage, unauthorized reuse, and malicious gradient manipulation. In this work, we propose an FL framework that couples keyed context-provenance watermarking with verifiable lattice-based secure aggregation of Real-World Anchored Watermarking and Lattice-Based Zero-Knowledge Secure Aggregation. At the data layer, we propose a Kerckhoffs-compliant scheme that utilizes Physical Anchor Metadata (PAM) to ensure data provenance. PAM is defined as a context-provenance token derived from trusted infrastructure data (time, location, and server ID) and then subjected to a keyed HMAC-SHA-256 transformation to produce a watermark payload that cannot be generated without the client's secret key. We further design FMGAN, a GAN-based robust image watermarking framework that embeds this transformed payload using a feature fusion module and a Mamba-guided linear attention mechanism. At the computation layer, we adopt a lattice-based zero-knowledge secure aggregation (LZKSA) protocol that verifies key correctness, L2 norm bounds, and cosine similarity constraints over committed gradients without revealing private updates. The RLWE-based design guarantees post-quantum security. Extensive experiments validate the complementary protection of the two layers under composite attack scenarios. To our knowledge, no prior verification workflow has jointly evaluated both layers in a hybrid, end-to-end trustworthy FL framework.

I. INTRODUCTION

Existing federated-learning defenses typically protect either data provenance or gradient aggregation, leaving multi-level attack surfaces insufficiently addressed. The paper proposes a dual-layer framework combining keyed PAM watermarking, FMGAN, and lattice-based zero-knowledge aggregation.

  • Existing FL defenses address data-layer provenance or gradient-aggregation security in isolation, leaving leakage, unauthorized dataset usage, and malicious model manipulation exposed.Source: §I · p. 1
  • The framework introduces a Kerckhoffs-compliant watermarking scheme that transforms Physical Anchor Metadata into keyed cryptographic payloads.PAM-derived payloads are designed to be infeasible to generate without the client’s secret key.Source: §I · pp. 1–2
  • The authors present the framework as the first joint verification workflow integrating data-security watermarking with lattice-based zero-knowledge secure aggregation.Source: §I · p. 2
  • FMGAN embeds PAM-derived watermarks using feature fusion and Mamba-guided linear attention in a GAN-based image-watermarking framework.Source: §I · p. 2
  • The computation layer integrates lattice-based zero-knowledge secure aggregation into practical FL workflows while preserving verification guarantees and reducing system complexity.Source: §I · p. 2
  • The complete pipeline is evaluated end to end for robustness against dataset leakage, unauthorized dataset usage, and gradient manipulation.The evaluation highlights complementary protection from PAM watermarking and lattice-based secure aggregation.Source: §I · p. 2

A. Image Authentication and Watermarking

Image authentication uses active methods such as watermarking to bind verifiable data to media, while FL secure aggregation protects update confidentiality but does not by itself validate update integrity. The paper positions these techniques within a broader provenance and computation-security context.

C. Threat Model

The threat model targets data authenticity and computation integrity across a distributed FL pipeline. The proposed design links trusted physical context to keyed watermarks and verifies extracted provenance during image authentication.

  • The attacker may know the watermarking architecture, embedding and extraction procedures, and public parameters, but not the private HMAC-driving key.Key generation and distribution are assumed secure.Source: C. Threat Model · p. 3
  • The framework separates data-security protection for local training data from computation-security protection for aggregated model updates.Source: §IV · p. 3
  • The physical anchor fabric generates verifiable PAMs from trusted ground-truth references and supports their generation and verification.Source: A. Keyed PAM Watermarking · p. 4
  • PAM combines time, location, ENF server ID, and error-correction information into a context-provenance representation sourced from trusted infrastructure.Source: A. Keyed PAM Watermarking · p. 4
  • The keyed watermark is produced through HMAC-SHA256 and embedded into images by FMGAN, preventing forgery without the client secret key.Source: A. Keyed PAM Watermarking · p. 4
  • Verification extracts the watermark and metadata, then accepts the asserted context only when the keyed PAM recomputation matches the extracted watermark.A positive result certifies a key-valid context-provenance token, not that the image content itself is genuine.Source: A. Keyed PAM Watermarking · p. 4

B. The Watermarking Model

FMGAN’s encoder combines feature fusion with Mamba-guided linear attention to embed watermarks while balancing image quality, robustness, and computational efficiency.

Encoder architecture

  • FMGAN’s encoder comprises a Feature-Fusion Module and a Mamba-Guided Linear Attention Module.The FFM extracts shallow and deep features through dense blocks, while MGLA guides watermark placement.Source: 1) Encoder · p. 5, Figure 3 · p. 5

Feature fusion

  • The FFM combines shallow and deep features across layers using dense blocks with BN, ReLU, and convolutional layers.Dense connections promote feature reuse and improve the encoder’s representation capability.Source: 1) Encoder · p. 5

MGLA design

  • MGLA replaces Mamba’s recurrent forget gate with parallelizable positional encodings and integrates depth-wise convolutions and gating into linear attention.This design preserves positional awareness while enabling parallel computation and efficient feature extraction.Source: 1) Encoder · pp. 5–6

Efficiency

  • MGLA achieves efficient global modeling with linear complexity O(N) and fully parallelizable computation.Its complexity terms correspond to projections, linear attention, depth-wise convolution, and MLP operations.Source: 1) Encoder · p. 6

Adaptive watermark placement

  • MGLA adaptively reweights spatial regions to modulate watermark strength and balance imperceptibility with robustness.The attention mask is generated from global cover-image features and applied to fused representations before residual encoding.Source: Figure 4 · p. 5, 1) Encoder · p. 6

Training objective

  • The encoder’s loss combines mean-square reconstruction error and structural similarity to reduce visual discrepancy between cover and encoded images.The coefficients ϵ1 and ϵ2 weight the reconstruction and visual losses, respectively.Source: 1) Encoder · p. 6

2) Decoder for Watermark Retrieval:

The decoder is trained with differentiable noise and feedback from watermark extraction, enabling recovery of the embedded watermark from distorted images without the original image.

Noise-aware training

  • The noise module applies differentiable distortions during training to improve watermarking robustness.Noised features are generated as Fnoise = Noise(Fen, Ntrain).Source: 2) Decoder for Watermark Retrieval · p. 6

Watermark retrieval

  • The decoder extracts the watermark from noised features as Wout = Dβ(Fnoise).Training minimizes the discrepancy between extracted Wout and original Win with respect to decoder parameters β.Source: 2) Decoder for Watermark Retrieval · p. 6

Robustness feedback

  • Decoder feedback guides the encoder away from fragile feature regions during noise-aware training.This collaborative optimization supports watermark recovery without requiring access to the original image.Source: 2) Decoder for Watermark Retrieval · p. 6

3) Discriminator:

The discriminator promotes inconspicuous and resilient watermarking, while LZKSA verifies masked gradients and norm or similarity constraints through RLWE-based commitments.

Discriminator

  • The discriminator distinguishes cover images from watermarked images and trains the encoder to make watermarked outputs harder to classify as fake.This adversarial loop supports inconspicuous and resilient embeddings against perceptual attacks.Source: 3) Discriminator · p. 6

Secure aggregation verification

  • LZKSA uses RLWE-based public-coin Σ-protocols to prove committed-input consistency and L∞-, L2-, and cosine-similarity constraints.The protocol avoids reducing each constraint to a generic zero-knowledge circuit.Source: C. LZKSA Security Protocol · pp. 6–7

RLWE commitments

  • The aggregation ciphertext is reused as the RLWE commitment, which is computationally hiding and binding under RLWE.This avoids a separate commitment layer.Source: C. LZKSA Security Protocol · p. 6

Verification workflow

  • Algorithm 1 returns Accept only after verifying key, L∞, L2, and cosine proofs, then aggregates the accepted ciphertext.Failed verification causes rejection.Source: C. LZKSA Security Protocol · p. 7

Mask verification

  • LZKSA proves global mask cancellation and pairwise mask consistency, allowing inconsistent clients to be identified.The pairwise check provides information unavailable from global cancellation alone.Source: C. LZKSA Security Protocol · p. 7

Constraint proofs

  • The verifier checks bounded coefficients, squared L2 norms, and cosine thresholds using specialized commitments and consistency equations.The cosine constraint is reduced to a bounded scalar comparison against a public reference vector.Source: C. LZKSA Security Protocol · p. 7

D. Cross-Layer Security Complementarity

The keyed PAM watermarking and LZKSA layers protect distinct, complementary parts of federated learning: data assets and gradient aggregation.

Data layer

Computation layer

V. EXPERIMENTAL RESULTS

The experiments evaluate the dual-layer framework at component and system levels in a simulated federated learning environment. Metrics cover watermark imperceptibility, extraction robustness, secure-aggregation verification, and composite attacks.

Evaluation Scope

  • The evaluation combines component-level watermarking and LZKSA analysis with system-level testing under composite attack scenarios.The component analysis covers watermark imperceptibility and robustness alongside LZKSA correctness and efficiency.Source: §V · p. 7

Implementation

  • The simulated FL environment uses private client datasets, masked gradients, and server-side LZKSA secure aggregation.Watermarking experiments use PyTorch on an NVIDIA Tesla V100 with COCO, ImageNet-10, and FFHQ images resized to 512 × 512 × 3.Source: A. Experimental Setup · p. 7

Metrics

  • PSNR and SSIM measure watermark imperceptibility, while Bit Accuracy measures extraction robustness.SA is the baseline; ZK∞, ZK2, and ZKcos denote zero-knowledge bounds for update norms and cosine similarity.Source: A. Experimental Setup · p. 7

Evaluation Scope

  • Table I compares different watermarking models on the COCO dataset.The table is part of the watermarking evaluation setup.Source: Table I · p. 8

B. Component-Level Evaluation

FMGAN is evaluated for imperceptibility, robustness, generalization, and resistance to watermark removal. Results report strong fidelity and extraction performance, while removal attacks substantially reduce detection and bit accuracy but introduce visible artifacts.

Watermark Invisibility

  • 41.59 dB PSNR and 0.9902 SSIM are achieved by FMGAN at a 64-bit payload on 1,000 COCO images.The keyed design limits keyless forgery probability per trial to 2^-w, and HMAC-SHA256 adds 0.01 ms overhead.Source: 1) Evaluation of FMGAN Watermarking · p. 8
  • Attention masks place stronger watermark signals in texture-rich regions, keeping watermarked images perceptually indistinguishable from originals.Figure 5 presents original images, attention masks, and watermarked images.Source: 1) Evaluation of FMGAN Watermarking · p. 8, Figure 5 · p. 8

Watermark Robustness

  • 96.37% BA under Gaussian noise with σ2 = 0.10 and a 20.77% advantage under JPEG QF = 10 demonstrate FMGAN’s robustness over HiDDeN.The model also remains robust to color and geometric distortions when the payload is scaled to 64 bits.Source: 1) Evaluation of FMGAN Watermarking · p. 8

Comparison With SOTA Models

Watermark Removal Attack

  • TPR@1%FPR falls from 1.00 to 0.02 and average Bit Accuracy from 1.00 to 0.43 after a state-of-the-art watermark removal attack.The regenerated images retain primary structures but contain perceptible fine-grained background inconsistencies.Source: 1) Evaluation of FMGAN Watermarking · p. 9, Figure 6 · p. 9

2) Evaluation of Secure Aggregation:

The secure-aggregation evaluation measures LZKSA across datasets ranging from 19k to 11181k parameters and under composite threats. Verification adds limited client and server overhead while supporting detection of dataset replacement and gradient scaling.

Efficiency Evaluation

  • Figure 7 compares LZKSA with standard SA for five datasets and 50 clients across parameter sizes from 19k to 11181k.Both per-client and server-side computation times are reported.Source: Figure 7 · p. 9, 2) Evaluation of Secure Aggregation · p. 9
  • Below 0.2 seconds, client-side verification time remains reported for 19k and 62k datasets across key and data-validation protocols.The passage characterizes this overhead as insignificant compared with overall SA execution time.Source: 2) Evaluation of Secure Aggregation · p. 9
  • Server-side verification time grows linearly with user size, with ZKcos incurring the largest overhead because it verifies all clients using more complex arithmetic.Even at 11181k, the reported server-side verification time remains within an acceptable range.Source: 2) Evaluation of Secure Aggregation · p. 9
  • The experiments conclude that LZKSA provides scalable input verification with minimal client and server computational overhead.The stated conclusion is that added security guarantees do not sacrifice FL practicality in large-scale, high-dimensional settings.Source: 2) Evaluation of Secure Aggregation · p. 10

Composite Attack Evaluation

2) Attack II: Forged Data Injection and Directional Gradient Manipulation:

Attack II combines forged-data injection with directional gradient manipulation, while a further evaluation tests watermark suppression and malformed aggregation behavior. The framework reports perfect forged-data detection, tuned cosine-threshold filtering, robust watermark extraction, and negligible proof-bypass probability.

Detection Results

  • 100% detection with zero false positives is reported for forged-data injection, while α = 0.8 balances cosine-based anomaly filtering and update utility.The cosine constraint compares the input gradient x with median benchmark y using threshold α.Source: 2) Attack II: Forged Data Injection… · p. 10

Aggregation Integrity

  • Malformed encrypted gradients, replay attacks, and invalid zero-knowledge proofs are rejected when the verification equation does not match.The stated success probability under the RLWE assumption is negligible in the security parameter.Source: 3) Attack III: Data Noise Perturbation… · pp. 10–11

Watermark Suppression

  • FMGAN achieves the highest BA across crop, dropout, blur, resize, and JPEG distortion intensities in the watermark-suppression evaluation.FMGAN and FMGAN-NN outperform their HiDDeN counterparts under cropping and dropout, while FMGAN remains strong under Gaussian blur.Source: 3) Attack III: Data Noise Perturbation… · p. 11, Figure 8 · p. 11

Utility Evaluation

  • The utility evaluation reports test accuracy for watermarking and each private-validation component on the original FL task.Table VIII defines the watermark column as accuracy with watermark-trained images and the remaining columns as accuracy after private validation.Source: Table VIII · p. 11

Watermark Suppression

  • Noise-aware training improves BA for both FMGAN and HiDDeN, while feature fusion preserves stable extraction for FMGAN-NN without explicit noise-aware training.The comparison is made against the corresponding NN variants.Source: 3) Attack III: Data Noise Perturbation… · p. 11

4) Utility Impact on the Original FL Task:

The dual-layer framework preserves original federated-learning utility while retaining validation-based robustness under attack, with small benign-case accuracy costs and identified scope limitations.

Watermarking utility

  • 83.6% accuracy with watermarked images was only 0.2 percentage points below the 83.8% clean baseline.The result indicates that FMGAN embedding preserves downstream training performance.Source: 4) Utility Impact on the Original FL… · p. 11

Secure aggregation utility

  • 0.2 percentage points on MNIST-0.5 and 0.4 percentage points on CIFAR-10 quantify the Full scheme’s benign accuracy changes.The reported gap mainly stems from fixed-point representation and excluding updates that fail public validation parameters.Source: 4) Utility Impact on the Original FL… · p. 12

Robustness under attack

  • 80.1% accuracy under CIFAR-10 Trim attack with ZK2, ZK∞, and ZKcos recovered performance from 19.5% without validation.ZK2 and ZK∞ control update magnitude, while ZKcos adds directional consistency against a public cosine-similarity threshold.Source: 4) Utility Impact on the Original FL… · p. 12

System-level evaluation

  • System evaluations report mitigation of composite cross-layer threats without sacrificing aggregation accuracy or watermark extractability.The evaluated threats include dataset replacement, forged data injection, noise perturbations, and protocol abuse.Source: D. Experimental Discussions and… · p. 12

Limitations and future work

  • The watermarking evaluation primarily covers common distortions and noise, while adaptive removal attacks and non-image modalities remain future work.The stated future scope includes optimization- or learning-based attacks and text, audio, or multimodal federated learning.Source: D. Experimental Discussions and… · p. 12, §VI · p. 12

Related papers

Loading 2608.20580v1…