Efficient Secure Federated Learning via Information-Theoretically Secure Key Distribution: A Medical Imaging Case Study

1 Introduction

• Model updates remain vulnerable to inversion and membership-inference attacks even when federated learning keeps raw data local.Secure aggregation masks individual updates, but conventional shared secrets rely on classical public-key cryptography and are only computationally secure.Source: §1 · p. 1
• Finite-rate, perishable quantum keys make uncompressed medical-imaging updates unsustainable, potentially depleting buffers and stalling training.The cited example estimates hundreds of megabytes of key material per round per client for an uncompressed ResNet-50, against sustainable generation rates of 1–10 kbit s−1.Source: §1 · p. 2
• Prior quantum-secured FL work leaves sustained multi-round key use on realistic workloads or physical testbeds unaddressed.The paper identifies this as a gap in existing approaches to the tension between quantum key-generation constraints and FL payload size.Source: §1 · p. 2
• The framework combines frozen backbones, knowledge distillation, and quantization to reduce payloads and key consumption under physical generation constraints.Its evaluation uses a real CV quantum-key testbed for chest X-ray classification and reports reduced key use while maintaining accuracy.Source: §1 · p. 2

2 Proposed Framework

• Clients train classification heads with frozen backbones, quantize the parameters, and mask them with QKD-shared keys; the server dequantizes the aggregate and applies FedAvg.Pairwise masks cancel exactly in the server's sum.Source: §2 · p. 2

2.1 Quantum-Secured Ring Additive Masking

• Each client adds its right-neighbor key and subtracts its left-neighbor key, so the server's sum cancels all pairwise masks.The ring uses O(n) links rather than O(n^2), and each client's per-round key use is exactly 2×P for compressed payload size P.Source: §2.1 · p. 3

2.2 Compression Techniques

• Freezing the ImageNet-pretrained MobileNetV3-Small backbone leaves only its classification head trainable and transmitted, reducing transmitted parameters by about 3.5×.The full model has about 803 × 10^3 parameters, compared with about 229 × 10^3 in the head.Source: §2.2.1 · p. 3

2.2.2 Knowledge Distillation.

• A student distilled from a CheXpert-fine-tuned teacher supplies thoracic-specific features and reduces the transmitted head payload by a further 2.5× relative to the frozen teacher head.The student is then frozen, with only its classification head transmitted.Source: §2.2.2 · p. 3

2.2.3 Quantization.

• Transmitted parameters use symmetric fixed-width quantization at 32-, 16-, or 8-bit precision, while local training remains in float32.The clipping range is [−8.0, +8.0].Source: §2.2.3 · p. 3

3.1 Dataset and Partitioning

• NIH ChestX-ray14 provides 112,120 frontal images from 30,805 patients across 15 classes, partitioned into patient-disjoint IID or Dirichlet-skewed clients.The official split has 86,524 training and 25,596 test images; CheXpert is used for student distillation pretraining.Source: §3.1 · pp. 3–4

3.2 Model Architecture

• MobileNetV3-Small teacher and compact CheXpert-distilled student configurations compare trainable and frozen backbones; masked runs train and transmit only classifier heads.The teacher has approximately 803 × 10^3 parameters, while the student has approximately 337 × 10^3 total parameters; student distillation reaches mean AUC 0.761 on CheXpert validation.Source: §3.2 · p. 4, §3.3 · p. 4

3.3 Federated Learning Configuration

• Six physical clients run FedAvg for 50 rounds with one local epoch per round, CPU-only training, and approximately four minutes per round.Each client trains in parallel across 12 logical cores; masked experiments use frozen backbones with only the classification head trainable.Source: §3.3 · p. 4

3.4 Quantum Key Distribution Network

• Three transmitters and three receivers form six logical ring links, with alternating link sets and per-link buffers supporting key availability despite a 50% duty cycle.The co-located prototype operates at approximately 10 kbit s−1 per active link; a metropolitan-fiber demonstration is planned as future work.Source: §3.4 · p. 4

3.5 Evaluation Metrics

• Performance is evaluated using macro-averaged one-versus-rest AUROC.Source: §3.5 · p. 4

4.1 Classification Performance

• 8-bit quantization degrades AUROC by up to ∼0.02 versus 32-bit, while non-IID partitioning reduces AUROC by ∼0.01–0.02 across configurations.Source: §4.1 · p. 4
• After 50 rounds, the uncompressed teacher scores 0.762 IID AUROC, versus 0.745 IID for the frozen teacher and 0.748 IID for the CheXpert-distilled student.The student recovers much of the frozen-teacher gap.Source: §4.1 · p. 4, Table 1 · p. 5

4.2 Key Consumption and Sustainability

• ∼35× lower per-round key consumption makes the 8-bit student indefinitely sustainable; the uncompressed baseline would exhaust a full buffer after ∼33 rounds.The other masked configurations complete 50 rounds using pre-charged buffers, with a worst-case deficit of ∼38 MB.Source: §4.2 · pp. 4–5, Table 2 · p. 5

Key findings

• 3.2 MB per round per link would exhaust a full buffer within ~33 rounds, while the 8-bit student uses 90 kB per link and is indefinitely sustainable.The corresponding minimum sustainable round durations are ~85 min and ~2.4 min, respectively.Source: §5 · p. 5

Accuracy trade-offs

• Domain-adapted distillation supplies thoracic-specific features, and quantizing the classification head from 32-bit to 8-bit introduces only marginal accuracy degradation.The discussion attributes most predictive capability to the frozen feature extractor rather than the rapidly updated head.Source: §5 · p. 5

Non-IID robustness

• Under aggressive label skew (α=0.1), the framework maintains stable convergence with only modest accuracy degradation relative to IID.The discussion suggests that restricting local updates to the linear head reduces divergence risk.Source: §5 · p. 5

Security considerations

• The security guarantees remove computational assumptions for key establishment and mask generation but retain trust in the aggregation server; implementation-level threats remain outside the model.The discussion notes that collusion resistance is weaker than with fully connected pairwise masking, and formal analysis of implementation-level threats is future work.Source: §5 · p. 5

Limitations

• The ring masking scheme requires every client to participate each round, and a server colluding with both ring neighbors can unmask a client's contribution.The scheme reduces required quantum key links from O(n^2) to O(n); dropout resilience and stronger collusion resistance are left for future work.Source: §5 · p. 5
• Evaluation covers one dataset, NIH ChestX-ray14, and one architecture family, MobileNetV3; empirical validation across diverse tasks remains necessary.Source: §5 · p. 6

• The framework combines frozen pretrained backbones, domain-adapting knowledge distillation, and fixed-width quantization to reduce key material consumption.Source: §6 · p. 6
• Key material consumption falls by up to ~35×, enabling sustained 50-round chest X-ray federated training without key buffer depletion while preserving accuracy.The evaluation uses a real CV quantum key testbed with six clients in a ring topology.Source: §6 · p. 6
• Future work will address dropout resilience and extend evaluation to other medical imaging modalities, backbone architectures, and alternative aggregation functions.Source: §6 · p. 6