MartFL: Utility-Driven Data Marketplace

• MartFL is a federated learning architecture that enables a utility-driven data marketplace by letting data providers trade local model updates instead of raw data.
• It employs a quality-aware aggregation protocol using cosine similarity clustering and random-inclusion to maintain robust, fair, and bias-resistant model integration.
• MartFL integrates verifiable transaction protocols with zero-knowledge proofs, ensuring transparent, efficient, and tamper-proof billing and reward distribution.

MartFL, introduced as "martFL: Enabling Utility-Driven Data Marketplace with a Robust and Verifiable Federated Learning Architecture" (Li et al., 2023), is a federated-learning architecture for a utility-driven data marketplace in which a Data Acquirer (DA) buys data utility, in form of local models or gradients, from Data Providers (DPs) without directly sharing raw data. The design combines a quality-aware model aggregation protocol, intended to remain robust even when the DA’s root dataset is biased, with a verifiable data transaction protocol that enables the DA to prove, both succinctly and in zero-knowledge, that it has faithfully aggregated local models according to committed aggregation weights. Subsequent benchmarking treated MartFL as a native mechanism for decentralized gradient marketplaces and argued that its behavior must be evaluated jointly in terms of model utility, robustness, buyer cost, fairness to sellers, and selection stability rather than by standard federated-learning metrics alone (Song et al., 6 Sep 2025).

1. Marketplace formulation and design objectives

MartFL is motivated by a data-marketplace setting in which a DA seeks to improve a machine-learning model, while multiple DPs hold private-domain data that are economically valuable but unsuitable for direct exchange because of privacy regulations or organizational constraints. The paper’s central premise is that the marketplace should trade data utility rather than raw data: DPs train local models on their own data and sell the usefulness of those updates to the DA. In this formulation, federated learning is not merely a collaborative training protocol; it becomes the mechanism by which private-domain data are converted into tradable model improvements (Li et al., 2023).

The architecture distinguishes three principal entities.

Entity	Role	Key asset
Data Acquirer (DA)	Initiates the FL task, evaluates local model quality, aggregates selected updates, and pays rewards	Small root dataset
Data Providers (DPs)	Train local models on private data and submit utility signals or plaintext local models if selected	Private local data
Blockchain / smart contract	Stores commitments, verifies proofs, and mediates reward distribution and penalties	Public immutable state

The paper identifies three deficiencies of standard or prior FL architectures in this setting. First, a DA cannot privately evaluate a DP’s local model before trading, while a DP does not want to reveal a useful update without payment assurance. Second, robust aggregation methods either rely on client-side statistics or on server-side root data; in a marketplace, the DA’s root dataset may be small, low quality, or biased, so server-driven methods may overfit to it. Third, conventional FL lacks a fair and verifiable billing mechanism: aggregation weights quantify contribution, but DPs ordinarily cannot verify that the DA really used the promised weights in the published global model. MartFL is explicitly designed around these three problems and assumes Byzantine DPs, a semi-honest DA, secure cryptographic primitives, a blockchain with finality, and a trusted setup for the zk-SNARK system (Li et al., 2023).

2. End-to-end protocol architecture

MartFL has two coupled pillars: quality-aware model evaluation and aggregation, and verifiable data transaction. The first determines which updates are worth buying and how much each should contribute. The second makes that choice auditable and economically enforceable. The workflow begins with model solicitation: at epoch $t$, the DA initializes a global model $W_g^{t-1}$, announces a training epoch, and deposits reward and penalty funds into a smart contract. Each DP $i$ then trains on its local dataset $D_i$, producing a local model $W_i^t$, or equivalently a local update

$u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$

In parallel, the DA computes its own baseline update $u_g^t$ from its root dataset $D_0$ (Li et al., 2023).

Before quality evaluation, DPs commit to their local updates. This commitment step is intended to prevent bait-and-switch behavior in which a DP is evaluated on one model and later submits a different one. The DA then performs private quality evaluation using homomorphic encryption: it encrypts the normalized baseline update,

$$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$

each DP computes a homomorphic inner-product contribution

$c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$

and the DA decrypts the result to obtain a cosine-similarity score. From the score vector, the DA selects a DP set $W_g^{t-1}$0 and an aggregation-weight vector $W_g^{t-1}$1, then commits those weights on-chain and deposits the corresponding reward and penalty funds. Only after this weight commitment do selected DPs submit plaintext local models off-chain. The DA aggregates them as

$W_g^{t-1}$2

where $W_g^{t-1}$3 and $W_g^{t-1}$4. It then produces a zero-knowledge proof that the published global model was computed from the committed local models using the committed weights. If proof verification succeeds, selected DPs claim rewards proportional to those weights; if it fails, the DA loses its penalty deposit. Finally, MartFL updates its baseline for the next epoch using preferred purchased models, so later rounds are not permanently anchored to the DA’s initial root dataset (Li et al., 2023).

3. Quality-aware evaluation, clustering, and dynamic baseline adjustment

The quality-evaluation stage is centered on cosine similarity between the DA’s baseline update and each DP’s local update. For epoch $W_g^{t-1}$5, MartFL computes

$W_g^{t-1}$6

A higher score indicates stronger alignment with the current baseline direction. Unlike FLTrust, MartFL does not directly convert this similarity into the final aggregation weight. Instead, it clusters the entire score distribution and uses the cluster structure to distinguish high-quality, qualified, and low-quality or malicious updates (Li et al., 2023).

The score set $W_g^{t-1}$7 is first analyzed with Gap Statistics to determine the number of clusters. MartFL then applies K-Means and treats three cases. If the distribution forms a single gathered cluster with small range, all models are included. If it forms a single scattered cluster whose score range exceeds threshold $W_g^{t-1}$8, the method forces two clusters and separates high-quality from low-quality models. If multiple clusters exist, MartFL identifies the highest-score cluster, discards the low-quality category, gives full pre-normalization weight to the best cluster, and gives reduced weight to other qualified clusters according to their distance from the best-cluster centroid $W_g^{t-1}$9. For a qualified-but-not-best model, the paper gives

$i$0

The resulting weights are normalized by $i$1. In the pseudocode, low-quality or malicious DPs receive weight $i$2, high-quality DPs receive weight $i$3 before normalization, and qualified DPs receive intermediate values (Li et al., 2023).

MartFL also includes a random-inclusion mechanism intended to preserve inclusiveness. If no qualified set remains and the high-quality set is too small, the algorithm samples additional DPs from the remainder using a small ratio $i$4, described in the paper as, for example, $i$5–$i$6. This is coupled with dynamic baseline adjustment. After trading, the DA evaluates purchased local models on the root dataset $i$7 with a Kappa coefficient and chooses a preferred DP for the next epoch according to

$i$8

The baseline is therefore updated from purchased models rather than staying permanently tied to the original root data. The paper presents this mechanism as a way to avoid overfitting to the DA’s root dataset and to improve inclusiveness under bias (Li et al., 2023).

4. Verifiable transaction protocol and zero-knowledge proof system

The second major component of MartFL is a verifiable settlement protocol. The critical statement to be proved is not the full correctness of score computation or clustering, but the narrower aggregation claim that the published global model is exactly the result of aggregating committed local updates with committed weights. The public input is

$i$9

the private witness is

$D_i$0

and the proof statement is essentially that there exist local updates $D_i$1, committed earlier, such that $D_i$2. This is the basis for fair billing: if the DA is forced to use the committed weights, selected DPs can unambiguously claim rewards attached to those weights (Li et al., 2023).

MartFL instantiates the proving pipeline with a compiled arithmetic circuit and Groth16. The paper describes the phases $D_i$3, $D_i$4, $D_i$5, and $D_i$6. The DA first commits to the witness using

$D_i$7

with POSEIDON used as the commitment or hash primitive because it is ZKP-friendly. Since model weights and aggregation coefficients are floating-point tensors, the protocol quantizes them into finite-field integers by

$D_i$8

and extends the range with $D_i$9 to reduce unsigned-integer subtraction overflow via

$W_i^t$0

The paper then derives proof-friendly aggregation and update circuits from the weighted-sum relation (Li et al., 2023).

A central efficiency technique is verifiable sampling. Proving correctness for every model parameter would scale with both the number of DPs and the model dimension. MartFL instead proves a fixed number $W_i^t$1 of randomly selected parameters, using publicly verifiable randomness derived from DP nonces and a VDF. The sampled coordinates define reduced public inputs and witnesses, so proof size becomes independent of the full model dimension. The paper frames the resulting system in standard zk terms—completeness, knowledge soundness, and zero knowledge—and argues that its practical consequence is succinct public verification on-chain while keeping local models hidden from public verifiers. In the smart-contract logic, the DA commits selected DPs and weights, deposits reward and penalty funds, posts the proof, and triggers either successful reward claims or automatic penalties if verification fails (Li et al., 2023).

5. Experimental evaluation, robustness, and systems overhead

The experimental study evaluates MartFL on FMNIST, CIFAR, TREC, and AGNEWS, using LeNet for FMNIST, TextCNN for TREC and AGNEWS, and a custom CNN for CIFAR. The setup uses 30 participants for image tasks and 20 participants for text tasks. The DA’s root dataset contains 200 samples for FMNIST, CIFAR, and AGNEWS, and 120 for TREC, corresponding to approximately $W_i^t$2, $W_i^t$3, $W_i^t$4, and $W_i^t$5 of the total DP-held data. The main metrics are MTA (main task accuracy), ASR (attack success rate), and DAC (data acquisition cost), defined as the average percentage of local models the DA purchases per epoch. The abstract reports that MartFL can improve model accuracy by up to $W_i^t$6 while saving up to $W_i^t$7 data acquisition cost (Li et al., 2023).

The strongest results appear when the DA’s root dataset is biased. On TREC with $W_i^t$8 biased DPs, the paper reports CFFL with MTA $W_i^t$9 and DAC $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$0, FLTrust with MTA $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$1 and DAC $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$2, and MartFL with MTA $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$3 and DAC $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$4. On AGNEWS with $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$5 biased DPs, it reports CFFL at $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$6 with DAC $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$7, FLTrust at $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$8 with DAC $u_i^t = \textsf{Flatten}(W_i^t - W_g^t).$9, and MartFL at $u_g^t$0 with DAC $u_g^t$1. On CIFAR with $u_g^t$2 biased DPs, it reports CFFL at $u_g^t$3 with DAC $u_g^t$4, FLTrust at $u_g^t$5 with DAC $u_g^t$6, and MartFL at $u_g^t$7 with DAC $u_g^t$8. Under unbiased root data, MartFL remains competitive while usually attaining the lowest DAC among the compared server-driven methods. The evaluation also studies untargeted attacks such as free-rider and sign-randomizing attacks, targeted attacks such as backdoor and label-flipping attacks, and Sybil attacks. The paper states that MartFL maintains high MTA even when up to $u_g^t$9 of DPs are malicious in the untargeted settings it reports, and that against targeted attacks it usually achieves the highest MTA and the lowest ASR, while reducing DAC by roughly $D_0$0 on average versus FLTrust in the robustness settings summarized in Table 4 (Li et al., 2023).

The systems study argues that quantization introduces negligible accuracy loss, with reported differences of $D_0$1 on TREC, $D_0$2 on AGNEWS, $D_0$3 on FMNIST, and $D_0$4 on CIFAR. It further reports that smart-contract function costs are all below $D_0$5 wei and less than about $D_0$6 seconds execution time in the authors’ setup, and claims the smart-contract execution cost is at least $D_0$7 smaller than Omnilytics while supporting roughly $D_0$8 more participants and models with roughly $D_0$9 more parameters. These results support the paper’s claim that MartFL’s on-chain burden is controlled by proving only sampled aggregation constraints rather than performing full aggregation on-chain (Li et al., 2023).

6. Subsequent benchmarking, criticisms, and related distinctions

A later benchmark paper, "Benchmarking Robust Aggregation in Decentralized Gradient Marketplaces" (Song et al., 6 Sep 2025), reinterprets MartFL within a broader decentralized gradient marketplace (DGM) setting in which a buyer purchases gradients from many sellers rather than raw data. Its central claim is that standard FL benchmarks are too narrow for this setting, and that evaluation must include not only Accuracy, Attack Success Rate (ASR), and privacy-leakage indicators such as PSNR and SSIM, but also marketplace-specific quantities: Cost per round $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$0, Cost-of-Convergence $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$1, Malicious Selection Rate (MSR), Divergence–Selection Correlation, Payment Gini, Selection Diversity, and Stability (Jaccard). In the benchmarked environment, the buyer baseline is $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$2 of the full dataset, seller data occupy the remaining $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$3, the benchmark uses 30 sellers, 200 global rounds, seller sampling fraction $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$4, 2 local epochs, Adam, batch size 64, learning rate 0.001, and 10 repetitions (Song et al., 6 Sep 2025).

The benchmark’s main criticism is that MartFL can appear robust on clean utility while failing on robustness and fairness. As adversary rate rises from $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$5 to $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$6, MartFL’s clean accuracy under backdoor attack drops only slightly from about $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$7 to $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$8, close to the no-attack baseline of $$c_g^t = \textsf{Enc}\!\left(k,\frac{u_g^t}{\|u_g^t\|}\right),$$9, but ASR rises from $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$0 to $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$1. For standard backdoor attackers, malicious updates are still selected roughly $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$2 of the time at $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$3 adversary rate and $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$4 at $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$5, while benign control sellers are selected about $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$6 to $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$7. Under Sybil backdoor attacks, malicious selection rates are about $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$8 to $c_i^t = \frac{u_i^t}{\|u_i^t\|} \cdot c_g^t,$9, close to benign sellers and even slightly above benign at $W_g^{t-1}$00 adversary rate. The paper also reports what it calls deceptive efficiency: to reach $W_g^{t-1}$01 accuracy, the no-attack case uses about 460 gradients and around 22 rounds, a standard backdoor case about 400 gradients and around 24.5 rounds, and a Sybil backdoor case about 355 gradients and around 21.5 rounds. At adversary rate $W_g^{t-1}$02, benign seller compensation falls by about $W_g^{t-1}$03 under standard backdoor and about $W_g^{t-1}$04 under Sybil backdoor, while malicious sellers capture around $W_g^{t-1}$05 and $W_g^{t-1}$06 of selected cost respectively. In cross-method comparisons, MartFL does reasonably well on FMNIST filtering, fails badly on CIFAR-10 with MSR $W_g^{t-1}$07 against benign $W_g^{t-1}$08, and ties FLTrust on TREC at $W_g^{t-1}$09. The benchmark therefore argues that similarity-only filtering is insufficient in decentralized gradient marketplaces and that MartFL’s selection rule simultaneously acts as a robustness mechanism, a procurement rule, and a payment allocator (Song et al., 6 Sep 2025).

A common source of confusion is terminological rather than technical. MartFL is distinct from MarS-FL, which denotes a market share-based decision support framework for participation in FL among competitors, centered on $W_g^{t-1}$10-stable market conditions and friendliness $W_g^{t-1}$11 rather than a data-marketplace aggregation and settlement protocol (Wu et al., 2021). It is likewise distinct from MAR-FL, a peer-to-peer federated learning system based on iterative group-based aggregation and communication complexity $W_g^{t-1}$12, rather than a buyer-baseline marketplace with quality-aware procurement and zero-knowledge billing (Mulitze et al., 4 Dec 2025). This suggests that MartFL should be understood specifically as a marketplace architecture for trading model utility under privacy, robustness, and verifiability constraints, not as a general label for market-aware or decentralized federated learning.