SoK: Verifiable Integrity Claims for Privacy-Preserving Federated Learning
Authors: Andrea Rizzini (Politecnico di Milano, Horizen Labs), Marco Esposito (Politecnico di Milano), Tommaso Gagliardoni (Horizen Labs), Francesco Bruschi (Politecnico di Milano)
Volume: 2026
Issue: 4
Pages: 248–271
DOI: https://doi.org/10.56553/popets-2026-0119
Abstract: Federated Learning (FL) is an advancement in Machine Learning motivated by the need to preserve the privacy of the data used to train models. While it effectively addresses this issue, the multi-participant paradigm on which it is based introduces several challenges. Among these are the risks that participating entities may behave dishonestly and fail to perform their tasks correctly. This misbehavior, in turn, also threatens privacy, because an undetected deviation in training or aggregation can silently undermine the confidentiality guarantees that FL was designed to provide. This motivates mechanisms that provide checkable evidence that released checkpoints are consistent with a declared learning specification and an auditable execution trace. In this SoK, we model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes. We derive a taxonomy of recurring client-side and aggregator-side claims and use it to analyze representative verifiable FL (VFL) systems spanning Zero-Knowledge Proofs (ZKP) and Trusted Execution Environment (TEE) technologies. Our analysis suggests that, while verifiable aggregation is comparatively mature, data verifiability appears feasible but still sparsely adopted in practice, and verifiable training remain costly and rarely scale to modern models.
Keywords: Federated learning, privacy-preserving machine learning, secure aggregation, verifiable computation, auditability
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
