Verifiable Federated Learning Protocol

• Verifiable federated learning protocol is a framework that combines cryptographic tools like ZKPs, homomorphic commitments, and blockchains to guarantee protocol compliance and protect data privacy.
• It verifies all phases of federated learning—from client selection and local computation to aggregation, evaluation, and unlearning—mitigating risks posed by malicious participants.
• The design balances verifiability and efficiency by using methods such as redundant aggregation, zero-knowledge proofs, and threshold cryptography to enhance scalability and robustness.

A verifiable federated learning protocol is a federated learning design in which one can check that parties do not deviate from the training procedure and perform computations correctly while it remains necessary to maintain the privacy of the training dataset (Korneev et al., 2024). In the recent literature, verifiability is attached not only to global aggregation and local learning, but also to federated evaluation, client selection, data authenticity, federated unlearning, and fairness verification. The resulting protocol landscape combines secure aggregation, homomorphic commitments or authenticators, zero-knowledge proofs, blockchains, threshold cryptography, and functional encryption under threat models that range from honest-but-curious servers to malicious servers, malicious clients, and malicious aggregators (Commey et al., 15 Jul 2025).

1. Conceptual scope and threat models

Verifiable federated learning emerged from the observation that privacy and correctness are distinct properties. Secure aggregation can conceal local models from the server, yet secure aggregation alone is inadequate for privacy protection when the server can manipulate the client selection process to isolate and extract a victim client’s local update (Nguyen et al., 2022). Likewise, aggregation integrity is a separate concern: an aggregator itself may behave maliciously, for example, by biasing the model or tampering with the weights to weaken the models privacy, and clients therefore require a way to verify the correctness of the aggregator’s computation without compromising the confidentiality of their updates (Bottoni et al., 5 Sep 2025).

The threat models surveyed for cross-silo verifiable FL include honest or trusted, honest-but-curious, forger, malicious, and drop-out robustness analyzed separately for clients and servers or miners (Korneev et al., 2024). Protocols also differ in whether they assume a centralized server, decentralized miners or validators, a dual-server architecture, multiple servers with at least one honest server, or a decentralized set of aggregators. Some systems explicitly target malicious aggregators rather than the more limited honest-but-curious assumption, as in VTSAFL, which assumes aggregators may be adversarial and proves security under the Decisional Diffie-Hellman assumption (Wang et al., 17 Nov 2025). Others target any subset of Byzantine clients, with at least one honest server, as in PRoVeFL (Kasyap et al., 7 Jul 2026).

Verifiability is also broader than numerical correctness of vector averaging. Recent protocols verify whether a local loss is below a threshold without revealing the loss value, whether a data batch originates from a certified device, whether a departing participant’s data has been forgotten, or whether demographic parity and equalized odds metrics satisfy a verifiable privacy-preserving computation (Commey et al., 15 Jul 2025). This broader scope is consistent with the open problem identified in the systematization of knowledge: no protocols currently verify all actions of both clients and servers at once, except PVD-FL, but with limitations (Korneev et al., 2024).

2. Protocol families and cryptographic foundations

The main taxonomy for verifiable cross-silo FL distinguishes four categories: Redundant Aggregation-based verification, Homomorphic Property-based verification, Zero-Knowledge Proof-based verification, and Data Embedding Based Verification (Korneev et al., 2024). Redundant Aggregation schemes use redundant values such as signatures or tags to prove correctness of aggregation. Homomorphic Property schemes use homomorphic cryptographic primitives such as commitments or authenticators to enable privacy-preserving verification of aggregated results. ZKP-based protocols allow a prover to convince a verifier that a computation was done correctly without revealing private data. Data Embedding approaches embed known values in shared data so correctness is confirmable post-aggregation (Korneev et al., 2024).

Homomorphic commitments and authenticators form one of the most direct approaches to aggregation integrity. e-SeaFL uses authenticated homomorphic vector commitments and assisting nodes so that the aggregation server can generate proof of honest aggregation to participants via authenticated homomorphic vector commitments (Behnia et al., 2023). A related line uses context-hiding identity-based multi-key linearly homomorphic authenticators: each client signs its update, the aggregator homomorphically aggregates the authenticators, and any client verifies the purported aggregate by checking

$$\text{check} = \mathrm{Ver}(\{vk_{id}\}_{id \in S}, x_{agg}, \sigma_{agg})$$

so that any deviation or manipulation in the purported aggregate will make $\mathrm{Ver}$ fail unless the aggregator breaks the unforgeability of the signature scheme (Bottoni et al., 5 Sep 2025).

Zero-knowledge proofs provide a more general but often more expensive mechanism. ZKP-FedEval uses zk-SNARK (Groth16) with a Circom circuit so that a client proves that its local loss is strictly less than a published threshold without revealing the numerical value of the loss or specifics of the client’s data (Commey et al., 15 Jul 2025). End-to-end verifiable decentralized federated learning uses zkSNARKs together with a two-step proving and verification method to extend verifiability from local computation and aggregation to device-level data authenticity (Lee et al., 2024). VerifBFL uses zk-SNARKs and incrementally verifiable computation so that proofs of training and aggregation are verified on-chain (Bellachia et al., 8 Jan 2025).

Threshold cryptography and functional encryption support verifiable aggregation under stronger adversarial models. VTSAFL constructs a partial decryption verifiable threshold multi client function encryption scheme in which aggregators perform partial decryption together with a zero-knowledge proof of correctness based on DLEQ, and clients verify partial decryptions before accepting an aggregation result (Wang et al., 17 Nov 2025). VFEFL instead proposes a decentralized verifiable functional encryption scheme that enables the verification of specific relationships over multi-dimensional ciphertexts, without a non-colluding dual-server setup or additional trusted third-party (Cai et al., 15 Jun 2025).

A separate lightweight design point is represented by dual-server linear-tag schemes. In that setting, a Computation Server and a Verification Server use pseudo-random functions and additive sharing to obtain secure aggregation with mutual server verification, constant verification tag size, and communication overhead comparable to plaintext aggregation (Zhou, 22 May 2026).

3. Canonical protocol workflows

At the aggregation layer, most verifiable protocols follow a recognizable structure: setup, local computation, cryptographic binding of local outputs, aggregation, proof generation, and verification. In a masking-based protocol with homomorphic authenticators, each client masks its update using pairwise secrets, signs the plaintext update, sends the masked update and authenticator, and the aggregator returns $x_{agg}$ and $\sigma_{agg}$ for client verification (Bottoni et al., 5 Sep 2025). In e-SeaFL, each user computes a commitment to its local gradient, the server aggregates commitments homomorphically, and users verify that the aggregate commitment matches the broadcast global model (Behnia et al., 2023).

In zero-knowledge threshold evaluation, the workflow is more specialized. ZKP-FedEval has the server publish the current global model $W_g$, a loss threshold $T$, and a round-specific random nonce $N_{\text{round}}$. Each client computes

$$L_i = \frac{1}{|D_i|} \sum_{x \in D_i} \ell(W_g, x),$$

and, if $L_i < T$, generates a zero-knowledge proof whose public inputs include the hash of $W_g$, the threshold $\mathrm{Ver}$0, and the nonce $\mathrm{Ver}$1 (Commey et al., 15 Jul 2025). The server learns only whether the client’s loss was below threshold and aggregates responses to estimate the fraction of clients with “good enough” performance (Commey et al., 15 Jul 2025).

Threshold functional-encryption protocols make verification client-visible. In VTSAFL, clients encrypt local model updates under round label $\mathrm{Ver}$2, aggregators compute partial decryptions together with DLEQ proofs, and each client runs Verify and then CombineRecovery with at least $\mathrm{Ver}$3 valid partial decryption results to recover the aggregated value for the current round (Wang et al., 17 Nov 2025). This transfers trust from a single aggregator to a threshold of aggregators.

Protocols designed for Byzantine robustness often split computation between ciphertext and plaintext domains. PRoVeFL uses multiple servers leveraging multi-key fully homomorphic encryption; clients encrypt local model updates, distribute encrypted shares to all servers, and publish per-coordinate commitments. The servers homomorphically evaluate the statistical parts of Byzantine-robust aggregation and reveal only masked outputs such as masked distances or masked similarities, which are then processed in plaintext for sorting, filtering, and thresholding (Kasyap et al., 7 Jul 2026). This design supports Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more, while requiring minimal trust in at least one honest server (Kasyap et al., 7 Jul 2026).

Some workflows explicitly verify data origin rather than only model arithmetic. The end-to-end decentralized protocol introduces a one-time registration workflow in which a worker proves in zero knowledge that a device certificate is valid and a learning workflow in which the worker proves that a signed commitment to the data batch comes from a certified device and that the local model update was computed from the current global model and that data (Lee et al., 2024). This is described as extending the chain of verifiability all the way back to the physical certified source device (Lee et al., 2024).

4. Specialized verifiability targets beyond aggregation

A notable development is that verifiable FL now covers protocol stages that were previously treated as ancillary. Federated evaluation is one example. ZKP-FedEval focuses on the evaluation phase, where shared performance metrics may leak sensitive information. Instead of revealing raw loss values, clients generate a succinct proof asserting that their local loss is below a predefined threshold, thereby revealing only a single bit per client (Commey et al., 15 Jul 2025).

Client selection is another case where verifiability changes the security boundary. The blockchain-based secure client selection protocol uses blockchain randomness, verifiable random functions, Merkle trees, and smart contracts so that the server cannot bias selection or target specific clients. The protocol satisfies pool consistency, pool quality, and anti-targeting, with the selection probability guarantee

$\mathrm{Ver}$4

under the stated assumptions (Nguyen et al., 2022). This addresses a privacy gap that arises even when secure aggregation is present.

Verifiable federated unlearning extends the same logic to the right to be forgotten. VeriFi defines a unified framework integrating federated unlearning and verification. The departing participant is granted the right to verify: it notifies the server before leaving, applies a marking function locally, the server applies an unlearning function, and the departing participant then checks whether the change in performance on the markers exceeds a threshold $\mathrm{Ver}$5 in the next few communication rounds (Gao et al., 2022). The framework studies 7 unlearning methods and 5 verification methods across 7 datasets and 4 types of deep learning models (Gao et al., 2022).

Fairness verification pushes verifiability into regulated statistical auditing. CryptoFair-FL combines additively homomorphic encryption with secure multi-party computation to enable privacy-preserving verification of demographic parity and equalized odds metrics without revealing protected attribute distributions or individual predictions (Ali et al., 18 Jan 2026). The framework includes a batched verification protocol with $\mathrm{Ver}$6 homomorphic operations and communication rounds, and it maintains $\mathrm{Ver}$7-differential privacy in the reported configuration (Ali et al., 18 Jan 2026). A plausible implication is that verifiable FL is increasingly being used to certify properties of the learning process that are orthogonal to raw model accuracy.

5. Efficiency, scalability, and empirical performance

The principal tension in verifiable FL is between expressive verification and system cost. The systematization of knowledge notes that ZKP-based schemes are the most versatile, as they can, in principle, verify arbitrarily complex computations, but may incur high preprocessing and prover costs (Korneev et al., 2024). Concrete systems therefore optimize different points in the design space.

ZKP-FedEval reports client proof generation time of approximately $\mathrm{Ver}$8 s per proof for MNIST with a CNN and $\mathrm{Ver}$9 s per proof for HAR with an MLP, with proof sizes of approximately $x_{agg}$0 KiB and $x_{agg}$1 KiB, respectively (Commey et al., 15 Jul 2025). VerifBFL reports that generating proofs for local training and aggregation takes less than $x_{agg}$2 s and $x_{agg}$3 s, respectively, while verifying them on-chain takes less than $x_{agg}$4 s (Bellachia et al., 8 Jan 2025). These two systems illustrate the gap between threshold predicates over small circuits and end-to-end blockchain-audited training proofs.

Homomorphic-authenticator systems target large modern networks. The context-hiding multi-key homomorphic authenticator protocol reports that for a model with 1 million parameters, generating authenticators takes approximately $x_{agg}$5 seconds per client, server-side authenticator aggregation takes $x_{agg}$6 ms for 1000 clients, and client-side verification takes approximately $x_{agg}$7 ms per client (Bottoni et al., 5 Sep 2025). The implementation was demonstrated for models with up to 5 million parameters (Bottoni et al., 5 Sep 2025).

Threshold and dual-server systems emphasize constant-size auxiliary objects and low communication. VTSAFL states that the size of the functional key and partial decryption results are constant, reducing the total training time by more than $x_{agg}$8 and reducing the communication overhead by up to $x_{agg}$9 relative to the cited existing scheme on MNIST (Wang et al., 17 Nov 2025). The dual-server linear-tag scheme reports that, with an input dimension of $\sigma_{agg}$0K, user computation time is reduced to $\sigma_{agg}$1 ms and verification time to $\sigma_{agg}$2 ms, with a constant tag size of $\sigma_{agg}$3 bytes (Zhou, 22 May 2026). PRoVeFL, which targets privacy, robustness, and verifiability simultaneously, reports performance improvements over Prio and ELSA up to $\sigma_{agg}$4 and $\sigma_{agg}$5, respectively (Kasyap et al., 7 Jul 2026).

Scalability claims also depend on the verification target. e-SeaFL takes only one communication round during the aggregation phase and reports an order of magnitude efficiency improvement over the state-of-the-art for large gradient vectors with thousands of parameters (Behnia et al., 2023). Gopa achieves verifiability while preserving the communication advantages of graph-based correlated noise exchange, with each honest party communicating with only a logarithmic number of other parties chosen at random (Sabater et al., 2020). Blockchain-based selection protocols reduce on-chain cost by Merkle summarization and off-chain VRF computation, with storage and gas essentially constant in the number of clients in the reported experiments (Nguyen et al., 2022).

6. Limitations, controversies, and open problems

Several recurring limitations are explicit in the literature. Groth16 requires a trusted setup, and ZKP-FedEval identifies this as a limitation that could be addressed in future versions via new ZKP systems (Commey et al., 15 Jul 2025). The same work also notes that the current implementation verifies a loss-threshold circuit, but not full general neural nets, because complex circuits become bottlenecks for deep models, and that the protocol reveals only whether $\sigma_{agg}$6, not gradient details for model improvement or troubleshooting (Commey et al., 15 Jul 2025).

Trust assumptions vary sharply across protocol families and remain a source of controversy. Dual-server schemes rely on non-collusion between the Computation Server and the Verification Server (Zhou, 22 May 2026). Multi-server systems such as PRoVeFL require at least one honest server (Kasyap et al., 7 Jul 2026). Blockchain-based protocols replace a single trusted aggregator with system-level trust, but the systematization of knowledge observes that blockchain-based approaches have high infrastructure cost and often are not justified in a cross-silo setting where parties are already known or trusted to a degree (Korneev et al., 2024).

A common misconception is that secure aggregation alone solves the main security problem. The client-selection attack literature explicitly shows otherwise (Nguyen et al., 2022). Another misconception is that verifiability necessarily implies disclosure of intermediate metrics or model contributions; in fact, several protocols are designed so that clients or servers learn only aggregate results, threshold outcomes, or public proof statements rather than the underlying local updates or losses (Commey et al., 15 Jul 2025).

The open research agenda remains extensive. The systematization of knowledge identifies full-stack verifiability, efficient verification beyond vector averaging, collusion resistance, leveraging the repetitive structure of FL for batching or amortized proofs, and recursive ZKP composition as major gaps (Korneev et al., 2024). This suggests that “verifiable federated learning protocol” is best understood not as a single construction, but as a family of cryptographic and systems techniques for making decentralized learning auditable under privacy constraints. Across secure evaluation, secure aggregation, certified data provenance, verifiable unlearning, and fairness auditing, the field is moving from proof of arithmetic correctness toward proof of protocol compliance across the entire federated lifecycle (Lee et al., 2024).