PaperlayerView exact revision on arXiv

Source-linked AI summary

HE-OFT: Privacy-Preserving One-Shot Federated Fine-Tuning under Homomorphic Encryption

Halil İbrahim Kanpak, Sinem Sav, Alptekin Küpçü

arXiv:2610.08255v1cs.CRcs.LG

TL;DR

Federated fine-tuning must protect both client updates and the resulting model, since even one update can expose private data and some models are regulated artifacts. HE-OFT uses one encrypted exchange and label-only encrypted serving; across five tasks, it achieves 61–79% accuracy versus 20–48% for one client alone while retaining 85–96% of disclosed-model accuracy.

  • Problem

    Privacy-preserving fine-tuning must protect intermediate updates and keep the trained model confidential, since even a single update and a model trained on confidential records can expose protected information.

    Source: I Introduction · p. 1

  • Method

    HE-OFT has each client train an adapter and classifier head locally, upload one encrypted head displacement, and use a shared encrypted head to return only a label to the querier.

    Source: I Introduction · p. 2

  • Results

    Across five tasks, HE-OFT reaches 61–79% accuracy versus 20–48% for a client alone, retaining 85–96% of disclosed-model accuracy.

    Source: I Introduction · p. 3

  • Takeaways & Limitations

    HE-OFT keeps the trained model from every party while a quorum returns only the predicted label to the querier.

    Source: VII Conclusion · p. 26

    The present guarantee does not cover robustness to actively malicious participants, leaving robust aggregation over encrypted contributions open.

    Source: VII Conclusion · p. 27

Abstract

from arXiv · show

Many organizations adapt large pretrained models to their own tasks by fine-tuning on private data. Several of these parties often hold data for the same task and wish to fine-tune a model together without pooling that data. Federated learning (FL) enables joint fine-tuning, but reconstruction attacks on shared intermediate values (the model or its gradients) remain a privacy risk. A one-shot protocol that exchanges one encrypted contribution exposes no intermediate value. Such a protocol still gives the trained model to every participant, which is not permitted where the model is a regulated or proprietary asset. We present HE-OFT, the first cryptographically secure one-shot federated fine-tuning protocol in which no party receives the trained model. Each client fine-tunes a low-rank adapter and a classifier head on a frozen public backbone and keeps the adapter. The client uploads one encrypted head displacement, which the server combines under multiparty CKKS and never decrypts. A quorum of clients returns only the predicted label to the querier. On four text classification tasks and one vision task, HE-OFT reaches 61 to 79 per cent accuracy, against 20 to 48 per cent for a client training alone. HE-OFT keeps 85 to 96 per cent of the accuracy of a disclosed model. A test-time query takes 443.1 to 1713.1 s on one core, or 56.1 to 255.1 s with level restoration on a GPU. Restoring levels at the server cuts the traffic per query from up to 1.6 GiB to 13.5 MiB.

I Introduction

Organizations with complementary data want to fine-tune models together without pooling confidential records, but federated updates can still expose private information. HE-OFT combines one encrypted contribution per client with a serving protocol that keeps the trained model undisclosed.

I Introduction

  • Across organizations with complementary task data, pooling records can be difficult because of data-protection restrictions, competition, or reluctance to trust the infrastructure operator.Organizations may have different patient populations, fraud patterns, or customer bases.Source: I Introduction · p. 1
  • Federated learning avoids moving data, but repeated client updates can expose privacy-sensitive information, making the protocol’s training-time disclosures and their frequency important.The cited membership-inference attack reaches 25.3% TPR at 0.1% FPR using per-round updates, versus 0.18% from a single snapshot.Source: I Introduction · p. 1
  • Unlike prior one-shot methods that send plaintext contributions and give participants the model, HE-OFT combines a single encrypted exchange with a model no party holds in plaintext.The comparison also distinguishes multi-round encrypted training and encrypted evaluation systems that return scores.Source: I Introduction · p. 2
  • The design places the shared trained map after the last nonlinearity, enabling the querier to compute features in plaintext while avoiding encrypted nonlinearities or intermediate decryption.Class totals remain encrypted because public totals could let all but one client recover the remaining client’s class histogram.Source: I Introduction · p. 2
  • A quorum computes the encrypted argmax and returns only the predicted label to the querier, since answers exposing logits could let a client recover the linear head.The supplied passage states that d+1 answers suffice, where d is the feature dimension.Source: I Introduction · p. 2
  • HE-OFT has clients train adapters and classifier heads locally, then upload one encrypted, per-class-count-weighted head displacement for aggregation without decryption.The shared head remains a ciphertext, and each client retains its adapter.Source: I Introduction · p. 2, Figure 1 · p. 2
  • The security contributions include a simulation proof against semi-honest parties, an input-privacy bound against malicious clients, and a proof that ciphertext decryption requires an honest server.The threat scenario excludes a deviating server because it could present arbitrary ciphertexts for client decryption.Source: I Introduction · pp. 1, 3
  • Across five tasks, HE-OFT reaches 61–79% accuracy versus 20–48% for a client alone, retaining 85–96% of disclosed-model accuracy.The evaluation uses pretrained RoBERTa-base and ViT-B/16 backbones.Source: I Introduction · p. 3

II Preliminaries

The preliminaries define the client-side adapter and head updates used in collaborative fine-tuning, then introduce the threshold homomorphic-encryption operations used by HE-OFT.

Collaborative Fine-Tuning

  • LoRA represents a backbone weight update as a rank-r down-projection followed by an up-projection; clients freeze the public down-projection and train the up-projection as an adapter.The backbone remains unchanged during parameter-efficient fine-tuning.Source: Collaborative Fine-Tuning · p. 3
  • Each client trains a linear classifier head from a public initializer, and its head displacement is its trained head minus that initializer.The head maps d-dimensional features to C class logits.Source: Collaborative Fine-Tuning · p. 3
  • One-shot FL replaces repeated update rounds with one exchange; HE-OFT uses that exchange for encrypted head displacements from which the server forms a shared head.Each client j has dataset size n_j and n_j,c examples of class c.Source: Collaborative Fine-Tuning · p. 3

Multiparty Homomorphic Encryption

  • Multiparty CKKS computes approximately on encrypted real-valued vectors under a collective key, with decryption requiring enough key-share holders and multiplication consuming finite levels.A collective refresh restores ciphertext levels; the implementation sets the threshold t equal to N.Source: Multiparty Homomorphic Encryption · p. 3
  • The scheme’s key generation, key switching, and collective refresh support shared-key computation, chosen-party decryption, and restoration of ciphertext levels, respectively.Any t clients form a decryption quorum, while fewer than t cannot decrypt.Source: Multiparty Homomorphic Encryption · p. 3

III Method

HE-OFT trains client-specific adapters locally and combines encrypted classifier-head displacements into a shared head, with aggregation and selection performed without decrypting the model. Queries return only a label to the querier; the method’s scope and costs depend on its linear shared head and encrypted operations.

Local Fine-Tuning of the Adapter and Head

Placement of the Shared Head

  • The shared trained quantity is placed after the backbone’s last nonlinearity, letting the querier compute features locally without evaluating the backbone under encryption.The paper evaluates classification; generation would require additional conditions, including greedy decoding.Source: Placement of the Shared Head · p. 4

Merging Client Contributions by Class Coverage

  • Each shared-head class row is the count-weighted average of contributing clients’ row displacements; uncovered rows remain at the public initializer.Only clients holding a class determine its row, so the per-class weights handle label skew.Source: Merging Client Contributions by Class… · p. 4

Per-Class Averaging Under Encryption

  • Per-class totals stay encrypted because revealing them to a coalition of N −1 clients would expose the remaining client’s class histogram.The server evaluates the reciprocal under encryption; classes with zero federation-wide count would cause division by zero, a case not observed in measured configurations.Source: Per-Class Averaging Under Encryption · pp. 4–5

Cost of the Encrypted Aggregation

  • The server performs ciphertext additions, one encrypted reciprocal, and one multiplication; communication is one upload per client, with no model-parameter download.The encrypted object is the head, sized by the number of classes and feature dimension.Source: Cost of the Encrypted Aggregation · p. 5

Prior-Weighted Estimator

  • The federation selects between the shared head with each client’s adapter and the shared head with the bare backbone by decrypting only the winning arrangement’s index.The prior-weighted estimator combines per-class accuracy evidence according to each class’s share of federation examples; a simpler client vote selects the personal arrangement in every measured cell.Source: Encrypted Scoring of the Shared Head… · p. 5, Prior-Weighted Estimator · p. 5

Accuracy Estimation per Class

  • Clients reserve at least one held-out example from every class they hold so the estimator can measure accuracy even for scarcely represented classes.For a client with one example of a class, that example is held out and the adapter does not train on that class.Source: Accuracy Estimation per Class · p. 5

Test-Time Query Protocol

IV Security

HE-OFT keeps adapters and the shared head encrypted or client-local, and inverts per-class totals under encryption. Its stated disclosure guarantee covers plaintext disclosure, while public sample counts and the selected arrangement index remain visible.

IV Security

  • Adapters stay with their owners, the shared head remains ciphertext, and encrypted inversion of per-class totals avoids plaintext disclosure of a remaining client’s histogram.The paper guarantees disclosure protection, not that a histogram cannot be recovered from other information such as the uploaded displacement.Source: IV Security · p. 8

The Ideal Functionality

  • The ideal functionality reveals public parameters, per-client sample counts, the selected index, and phase signals; each client receives labels for its queries up to Q.The guarantee is relative to this leakage.Source: The Ideal Functionality · p. 8

Security Against Semi-Honest Parties

The paper proves semi-honest security relative to an ideal functionality with specified leakage, under assumptions on threshold CKKS security and key-switch smudging. The proof’s bound is not informative when the smudging error is non-negligible.

Security Against Semi-Honest Parties

  • Under IND-CPA security for threshold CKKS and a key-switch smudging assumption, HE-OFT realizes the ideal functionality with leakage L against a semi-honest server and at most t −1 corrupted clients.The ideal functionality includes the selected index and query answers delivered to corrupted clients.Source: Security Against Semi-Honest Parties · p. 8
  • The proof replaces subprotocol outputs and ciphertexts with simulations and encryptions of zero, with its bound depending on subprotocol runs, ciphertexts, and query-driven key switches.The simulator’s output depends on honest clients’ data only through leakage L and the answers delivered to corrupted clients.Source: Security Against Semi-Honest Parties · p. 9
  • The security bound says nothing when the smudging error is not negligible, and the paper reports that its measured configuration is such a case.This limits what the theorem establishes for that configuration.Source: Security Against Semi-Honest Parties · pp. 9–10

Input Privacy Against Malicious Clients

For malicious clients with an honest server, the paper bounds input-privacy advantage by a negligible term plus the advantage available from their permitted label queries. The guarantee relies on restrictions on deviating messages and does not claim correctness against them.

Input Privacy Against Malicious Clients

  • The guarantee covers privacy against up to t −1 deviating clients with an honest server, not correctness against those clients.The malicious-client analysis considers their uploads, subprotocol shares, and queries.Source: Input Privacy Against Malicious Clients · p. 10
  • The input-privacy theorem bounds advantage by negl(λ)+δ((t −1)Q), where δ is the advantage available from that many label queries to the served head.The bound applies to equal-size challenge datasets leading to the same selected index.Source: Input Privacy Against Malicious Clients · pp. 10–11
  • Deviating messages must satisfy assumptions on extractable plaintexts, bounded noise, and bounded query features; HE-OFT does not include the proofs that could enforce these conditions.Malformed queries outside the comparison domain may yield a value that is not a label.Source: Input Privacy Against Malicious Clients · p. 10
  • A coalition of t −1 clients receives at most (t −1)Q answers, and Q is set using the cost of extracting a head copy at fidelity 0.90.The paper sets Q between three and five queries per head parameter.Source: Input Privacy Against Malicious Clients · p. 11

The Honest-Server Assumption

The honest-server assumption is necessary when clients decrypt ciphertexts presented by the server: ciphertext privacy prevents clients from gating decryption on the hidden plaintext. Verifying each presented ciphertext or certifying the evaluated function are proposed alternatives, each with different costs.

The Honest-Server Assumption

  • No protocol in which clients decrypt server-presented ciphertexts realizes FHE-OFT against a malicious server, because clients cannot distinguish ciphertexts by their plaintexts.Correctness requires clients to decrypt the prescribed ciphertext, so the same decision applies to a malicious server’s chosen ciphertext, up to a negligible difference.Source: The Honest-Server Assumption · p. 11
  • Bit-for-bit recomputation can verify every presented output ciphertext, but an unchecked request can leak the whole head when it fits in one ciphertext.The checker must recompute every query; at four classes, one request can present a whole head row.Source: The Honest-Server Assumption · p. 11
  • Broadcasting the encrypted head and querier features to the quorum enables checking, but adds traffic and reveals which client submitted the query.The quorum otherwise holds neither ciphertext; both remain encrypted when broadcast.Source: The Honest-Server Assumption · p. 11
  • A zero-knowledge proof of correct evaluation or verifiable homomorphic encryption can certify the server’s function without the checker’s two listed costs.The paper identifies both mechanisms as limitations of the specified protocol.Source: The Honest-Server Assumption · p. 11

Leakage to a Client Coalition

The analysis bounds what a client coalition learns through queries by what plaintext shared heads reveal, then evaluates membership and other attack families against that boundary. Measurements are generally close to random guessing, with scope limits including fixed coverage patterns and sparse low-false-positive-rate samples.

Leakage to a Client Coalition

  • A coalition learns clients’ public sample counts, ciphertexts, index and phase-signal shares, and its own answer contributions, but no per-class totals or adapter aggregate.Per-class totals are inverted under encryption and never decrypted; no adapter aggregate exists.Source: Leakage to a Client Coalition · p. 11
  • The coalition’s membership-inference advantage is at most negl(λ) + δwb, independent of the query allowance; increasing the threshold or allowance only lets it approach δwb.The query channel is no more informative than giving an adversary both shared heads in plaintext.Source: Leakage to a Client Coalition · pp. 11–12
  • With both shared heads disclosed, the likelihood-ratio attack’s AUC was 0.49–0.53 and TPR at FPR 0.01 was 0.008–0.023, close to random guessing.After fitting a head to 2 × 10^5 label-only answers, the same attack’s AUC was 0.48–0.50 and TPR at FPR 0.01 was 0.009–0.017; disclosed-head measurements also remained close to random guessing.Source: Leakage to a Client Coalition · pp. 12–13
  • The one-shot label-only attack reached AUC 0.47–0.52 across six cells; its calibration separated members from nonmembers by at most 0.065, usually below 0.01.The coalition can choose queries freely, but the tested crafted queries exposed no exploitable member/nonmember margin difference in the served head.Source: Leakage to a Client Coalition · p. 12
  • A correctness-based membership rule reached AUC 0.72 on Banking77, but the authors attribute this to a holdout enriched in rare classes, not membership.The likelihood-ratio attack calibrates examples against their own shadow distributions and does not inherit this confound.Source: Leakage to a Client Coalition · p. 12
  • A class row held by one client is not averaged across clients; its feature-direction margin was 0.012 versus 0.006 when six or more clients held the class.Across 570 rows, absolute cosine was 0.16 versus 0.029 for a random direction; the row points into the feature subspace but identifies neither a class nor a record.Source: Leakage to a Client Coalition · p. 12
  • The tested reconstruction, attribute-inference, and gradient-inversion attacks lack the needed structure: linear heads, no individual hidden activations, and a fixed public backbone.The reported reconstruction setting has a parameter-to-unknowns ratio of about 0.01, below the smallest ratio of 0.5 at which recovery was reported.Source: Leakage to a Client Coalition · pp. 12–13
  • Membership measurements resolve TPR only to 0.001 with 1,000 members, and measurements at FPR 0.001 use two to four examples; coverage patterns remain fixed.The experiments therefore do not show how leakage changes with the data partition.Source: Leakage to a Client Coalition · p. 13

Approximate Decryption and CPA-D Security

Approximate CKKS decryption returns error as well as the intended output, creating a repeated-query key-recovery risk. The measured smudging configuration also falls short of a stated simulation condition, while meeting it at the reported scale would erase the answer.

Approximate Decryption and CPA-D Security

  • The cited zero-noise threshold attack does not apply because CKKS lacks the observable rounding success needed to detect zero-noise ciphertexts.The cited result covers threshold CKKS without smudging.Source: Approximate Decryption and CPA-D… · p. 13
  • The measured smudging is eight times fresh-encryption noise, while the serving circuit leaves ciphertext noise several orders of magnitude larger, so the Theorem 1 simulation hypothesis is unmet.Whether an adversary can exploit the resulting circuit noise remains open.Source: Approximate Decryption and CPA-D… · p. 13
  • At plaintext scale 2^45, meeting the smudging requirement would exceed the scale and erase the answer, requiring a larger scale and modulus.The associated costs in the measured configuration would also change.Source: Approximate Decryption and CPA-D… · p. 13
  • Repeated identical queries can average away smudging error until rounding recovers the ring element, enabling key recovery from one ring inversion.The server holds the ciphertext components, and the stated adversary model includes the server together with t −1 clients.Source: Approximate Decryption and CPA-D… · p. 13
  • Duplicate-query checking is required: at eight times fresh-encryption noise and quorum ten, about 5 × 10^5 repetitions could suffice for recovery.Re-randomization makes a query a different ciphertext and therefore an independent sample; flooding sized for independent samples costs precision and requires rekeying when its budget is spent.Source: Approximate Decryption and CPA-D… · p. 13
  • Raising smudging to 2^25 leaves twenty bits of the 2^45 scale and increases repetitions quadratically without changing latency, traffic, or accuracy.The decrypted outputs are one index and one label, so the paper says they need only a few bits of precision.Source: Approximate Decryption and CPA-D… · p. 13
  • In 150 key switches, every answer returned the plaintext label and the decoded index was never more than 0.13 from the integer.The tested smudging of 2^25 exceeds the four-class and hundred-class served-ciphertext noise by 8 to 12 bits; the authors recommend this configuration.Source: Approximate Decryption and CPA-D… · p. 14
  • A rushing key-generation party can subtract others’ public-key shares and read uploads; the theorem therefore applies only with a commitment round.Commitments before opening shares cost one round, which is independent of the ring parameters.Source: Approximate Decryption and CPA-D… · p. 14

V Experiments

Experiments evaluate HE-OFT on four text-classification tasks and one vision task, comparing its servable arrangements with local, disclosed, and pooled references. Results assess accuracy, arrangement selection, sensitivity, and encrypted-selection costs.

Setup

  • Experiments use rank-8 adapters with frozen down-projections, four RoBERTa-base text tasks, and CIFAR-100 with a frozen ViT-B/16.Unless stated otherwise, evaluation uses ten clients, label-skew concentration α = 0.1, 200 local steps, and three-seed means; clients reserve held-out examples from classes they hold.Source: Setup · p. 14

One-Shot Encrypted Federated Learning

Handling Data Heterogeneity

  • The selection estimator chooses the better arrangement in 12 of 15 cells; filling unobserved classes with rare-class scores instead selects correctly in 13.The simpler majority of local held-out accuracies selects the personal arrangement in all fifteen cells, including cases where it is 0.17 and 0.18 worse.Source: Handling Data Heterogeneity · p. 16, Table 5 · p. 17
  • The estimator’s shared-arrangement accuracy estimate is within 0.019 on average across fifteen cells and within 0.005 across twelve CIFAR-10 cells; it is correct in eleven of those twelve.Its single CIFAR-10 error costs 0.006; on Banking77 it selects correctly on all three seeds despite wrong choices costing 0.48.Source: Handling Data Heterogeneity · p. 17
  • At five parties and 100 classes, encrypted selection performs 1,000 comparisons and takes 17.5 minutes under collective refresh.That timing is an upper bound on traffic and a lower bound on wall-clock time because the measurement does not use the specified server-side bootstrapping.Source: Handling Data Heterogeneity · p. 17

Comparison With Plaintext and Differentially Private One-Shot Federated Learning

This section compares HE-OFT’s label-only serving with plaintext-releasing and differentially private one-shot peers, focusing on test-time exposure and serving costs. It also examines model-copying risks and the accuracy tradeoff of randomized response, including limits on enforcing query metering.

Comparison With Plaintext and Differentially Private One-Shot Federated Learning

  • At N = 5 and α = 0.1, HE-OFT reaches Asel = 0.949 versus 0.503 for, and improves from Aloc = 0.384 using the same backbone.The cross-paper absolute comparison is not direct because trains a ResNet-18 from scratch while HE-OFT fine-tunes a frozen public ViT-B/16. HE-OFT keeps 98.5 to 100.3 per cent of the disclosed model’s accuracy over Table 6, and encryption does not degrade accuracy relative to plaintext computation.Source: Comparison With Plaintext and… · pp. 17–18, Table 6 · p. 18

Cryptographic Cost and Scalability

  • 443.1 s at four classes and 1713.1 s at a hundred are the single-core end-to-end query times; projected H100 level restoration reduces them to 56.1 s and 255.1 s.The encrypted argmax accounts for 96 to 99 per cent of query time; only level restoration is projected on the GPU, with local evaluation remaining on the processor.Source: Cryptographic Cost and Scalability · pp. 19–20, Figure 6 · p. 20
  • Selection costs 400 s and 3.4 GiB at five clients and four classes, rising to 7111 s and 145.4 GiB at twenty clients and a hundred classes, but is paid only once.The selection rule correctly identifies the winning arrangement in all twelve measured grid cells.Source: Cryptographic Cost and Scalability · p. 21
  • At a hundred classes, server-side level restoration removes roughly 1.6 GiB of client traffic per query, while adding one-time bootstrapping-key generation of 8.70 GiB.The specified server-side design is about thirteen times slower than collective refresh, but the one-time key generation and per-query traffic savings break even near the sixth query. At N = 10, total traffic is 13.5 MiB per query.Source: Cryptographic Cost and Scalability · pp. 18, 22

Extraction and Membership at Test Time

  • HE-OFT exposes no training-time artifact or model; only the sequence of served answers remains as a channel, bounded by the query allowance.Source: Extraction and Membership at Test Time · p. 22
  • A copy at fidelity 0.90 costs 16 to 260 times as many queries from labels as from scores, while a released model offers fidelity 1 without queries.Returning scores allows recovery of a linear head from d + 1 answers; HE-OFT returns labels alone.Source: Extraction and Membership at Test Time · pp. 22, 24, Table 10 · p. 22
  • Reaching fidelity 0.90 takes about 1.2×10^4 queries on AG-News, 5.0×10^4 on DBpedia, and 2.0 × 10^5 on Banking77.Across the three tasks, fidelity 0.90 costs three to five queries per head parameter; the reported query multiplier depends on the target fidelity.Source: Extraction and Membership at Test Time · p. 23
  • At N = 10, keeping a coalition below fidelity 0.90 requires fewer than roughly 1.3 × 10^3 queries per client on AG-News and 2.2 × 10^4 on Banking77.The small label space is the binding case; the measurements use a quorum of all clients, t = N.Source: Extraction and Membership at Test Time · p. 23
  • A high-fidelity copy does not itself reveal a client’s records: the attack fits a linear map from chosen queries, while membership inference is reported as close to a random guess.The passages distinguish copying the shared head from inferring membership, and state that no gradient, update, or data-derived summary is available in plaintext.Source: Extraction and Membership at Test Time · pp. 22–23
  • The quorum and server learn who queried and how often; query allowances also require trusted enforcement, since a corrupt server can refuse to count and sub-quorums can split queries.The paper identifies t = N or a separate trusted metering service as ways to enforce a per-client allowance.Source: Extraction and Membership at Test Time · p. 23
  • The boundary-bisection variant performs worse in 13 of 15 cells, but crosses over on AG-News at about 16 queries per parameter and outperforms the random strategy at 65.At 65 queries per parameter, it leaves 0.0041 of decisions wrong versus 0.0072 for the random strategy; the paper reports the random strategy for the range relevant to an allowance.Source: Extraction and Membership at Test Time · p. 23
  • At ε = 1 on AG-News, randomized response leaves copy fidelity at 0.774 but lowers served-model accuracy to 0.372, below the 0.488 majority-class share.The mechanism lowers fidelity and accuracy together; the paper therefore favors query metering over answer perturbation.Source: Extraction and Membership at Test Time · p. 24, Table 11 · p. 24

VI Related Work

Prior systems meet only subsets of the paper’s requirements; HE-OFT combines one-shot training, encrypted contributions, and no disclosure of the trained model. The related work distinguishes it from prior approaches to federated learning, encrypted training, and secure inference.

VI Related Work

  • No prior system combines one-shot training, encrypted contributions, and nondisclosure of the trained model, according to the authors.The closest systems send plaintext contributions, protect only some stages, or serve a model they did not train.Source: VI Related Work · p. 24

Attacks on Federated Learning

  • Repeated updates expose more attack surface: they can reveal gradients, membership, data properties, or even client inputs.An observer of per-round updates can infer membership and unintended data properties; a malicious server can craft weights to elicit client inputs.Source: Attacks on Federated Learning · p. 25

Protecting Training With Cryptography

  • Prior encrypted-training approaches use iterative circuits or encrypt per-round sums, while HE-OFT trains locally in plaintext and encrypts only the result.Encrypted nonlinearities can require deep circuits and repeated bootstrapping; several other systems protect each round’s sum, and some assume the server and clients do not collude.Source: Protecting Training With Cryptography · p. 25

One-Shot Federated Learning and Federated Fine-Tuning

  • One-shot methods commonly send models or distillates in plaintext; differential-privacy peers add noise, while federated adapter methods also send plaintext contributions.HE-OFT instead encrypts its contribution; the cited discussion says this merge loses no accuracy relative to its unprotected merge.Source: One-Shot Federated Learning and… · pp. 25–26

Secure Inference

  • Prior secure-inference systems either evaluate whole networks and return scores, serve a trained unit held in plaintext by a provider, or use single-key maxima without collective refreshes.The paper’s served map is linear in the features; a trained map inside the backbone would require secure transformer inference.Source: Secure Inference · p. 26

VII Conclusion

HE-OFT keeps the trained model from every party while allowing a querier to receive a predicted label. Across five tasks, it outperforms client-alone training and retains 85 to 96 per cent of disclosed-model accuracy, with limits around linearity, malicious clients, and availability.

VII Conclusion

  • Each client keeps its adapter and uploads one encrypted head displacement; the server combines contributions without decrypting, and a quorum returns only the label.The querier computes query features using the public backbone and its own adapter; HE-OFT shares only a trained map after the network’s last nonlinearity.Source: VII Conclusion · p. 26
  • 85 to 96 per cent of the accuracy of a model that is aggregated and disclosed is retained across four text classification tasks and one vision task.HE-OFT is more accurate than any client alone on those tasks.Source: VII Conclusion · p. 26
  • The no-model-disclosure requirement forces a linear shared quantity, limiting the approach relative to a shared adapter that adapts every participant’s representation.Serving a shared adapter inside the backbone would require secure transformer inference.Source: VII Conclusion · p. 26
  • Serving assumes a public bound on the exported head’s norm, and the cost of a loose bound was not measured.The circuit’s polynomial approximation resolves a fixed absolute margin, which changes when logits are scaled.Source: VII Conclusion · p. 26
  • The query allowance is an operational control; calibrated noise could bound cumulative leakage when no allowance separates honest use from extraction, but reported accuracy excludes that mechanism.The paper presents robustness to actively malicious participants and a shared adapter inside the backbone as future directions.Source: VII Conclusion · pp. 26–27
  • The cryptographic guarantees assume semi-honest parties; a crafted encrypted head displacement can bias the shared head, and robust aggregation remains future work.The server cannot inspect an encrypted upload; proposed defenses include a per-upload norm bound enforced by a zero-knowledge proof or encrypted robust aggregation.Source: VII Conclusion · pp. 26–27
  • Measurements use t = N, so every client must participate for a query; lowering the threshold improves availability but lets a coalition of t clients decrypt.The implementation’s setting means one unavailable client blocks queries until that client returns.Source: VII Conclusion · p. 27
Loading 2610.08255v1…