DIST-FL: Enhancing Security for TEE-based Aggregation in Federated Learning

• URL: http://arxiv.org/abs/2606.04899v2
• Date: Thu, 04 Jun 2026 02:56:49 GMT
• Title: DIST-FL: Enhancing Security for TEE-based Aggregation in Federated Learning
• Abstract summary: Server-side adversaries can still manipulate client selection and replay aggregation to compromise system robustness and privacy.<n>We present DIST-FL, a distributed system of servers guarded by multiple TEEs forming an append-only ledger for privacy-preserved, robust FL aggregation.
• Score: 37.95865837498057
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Trusted Execution Environments (TEEs)-aided federated learning protocols emerge as promising solutions to counter server-side adversaries and ensure the trustworthiness of the server. In this paper, we dissect existing protocols and demonstrate that server-side adversaries can still manipulate client selection and replay aggregation to compromise system robustness and privacy, by exploiting TEE limitations, i.e., state rollback and I/O manipulation. To this end, we present DIST-FL, a distributed system of servers guarded by multiple TEEs forming an append-only ledger for privacy-preserved, robust FL aggregation. Specifically, DIST-FL ensures operation linearizability to thwart state rollback attacks and incorporates inputs from reliable servers to mitigate I/O manipulation threats. We implement DIST-FL and conduct evaluations in WAN settings. Experimental results demonstrate that DIST-FL can effectively counter the proposed attacks and match the single-TEE's performance while offering a 6x throughput boost over its counterparts, leveraging TEE's computational advantages.

Related papers

• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• Multi-Agent-Driven Cognitive Secure Communications in Satellite-Terrestrial Networks [58.70163955407538]
  Malicious eavesdroppers pose a serious threat to private information via satellite-terrestrial networks (STNs)<n>We propose a cognitive secure communication framework driven by multiple agents that coordinates spectrum scheduling and protection through real-time sensing.<n>We exploit generative adversarial networks to produce adversarial matrices, and employ learning-aided power control to set real and adversarial signal powers for protection layer.
  arXiv  Detail & Related papers  (2026-01-06T10:30:41Z)
• Verification of Lightning Network Channel Balances with Trusted Execution Environments (TEE) [0.05330327625867509]
  This paper introduces a methodology for the verification of LN channel balances.<n>The core contribution is a framework that combines Trusted Execution Environments (TEEs) with Zero-Knowledge Transport Layer Security (zkTLS) to provide strong, hardware-backed guarantees.
  arXiv  Detail & Related papers  (2025-12-12T23:55:12Z)
• PDRIMA: A Policy-Driven Runtime Integrity Measurement and Attestation Approach for ARM TrustZone-based TEE [3.360308805410428]
  ARM TrustZones are widely used in IoT and embedded devices to protect sensitive code and data.<n>Most existing defenses focus on secure boot or REE-side monitoring and provide little visibility into the runtime integrity of the TEE.<n>We propose Policy-Driven Integrity Measurement and runtime integrity protection approach for TrustZone-based TEEs.
  arXiv  Detail & Related papers  (2025-12-06T17:12:54Z)
• Securing Private Federated Learning in a Malicious Setting: A Scalable TEE-Based Approach with Client Auditing [0.9310318514564272]
  Differentially private follow-the-regularized-leader (DP-FTRL) has emerged as a promising privacy-preserving method.<n>Existing approaches assume a semi-honest server and have not addressed the challenge of securely removing this assumption.<n>This paper introduces a novel server extension that acts as a trusted computing base to realize maliciously secure DP-FTRL.
  arXiv  Detail & Related papers  (2025-09-10T15:58:05Z)
• R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning [69.72249695674665]
  We propose a robust test-time prompt tuning (R-TPT) for vision-language models (VLMs)<n>R-TPT mitigates the impact of adversarial attacks during the inference stage.<n>We introduce a plug-and-play reliability-based weighted ensembling strategy to strengthen the defense.
  arXiv  Detail & Related papers  (2025-04-15T13:49:31Z)
• Poisoning Prevention in Federated Learning and Differential Privacy via Stateful Proofs of Execution [8.92716309877259]
  Federated Learning (FL) and Local Differential Privacy (LDP) have attracted much attention over the past few years.<n>They share the common limitation of being vulnerable to poisoning attacks.<n>We propose a system-level approach to remedy this issue based on a novel security notion of Proofs of Stateful Execution.
  arXiv  Detail & Related papers  (2024-04-10T04:18:26Z)
• Teamwork Makes TEE Work: Open and Resilient Remote Attestation on Decentralized Trust [11.664322958897449]
  Remote (RA) enables the integrity and authenticity of applications in Trusted Execution Environment (TEE) to be verified. Existing TEE RA designs employ a centralized trust model where they rely on a single provisioned secret key and a centralized verifier to establish trust for remote parties. This model is however brittle and can be untrusted under advanced attacks nowadays. Most designs only have fixed procedures once deployed, making them hard to adapt to different emerging situations and provide resilient functionalities.
  arXiv  Detail & Related papers  (2024-02-14T02:51:01Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• Towards Bidirectional Protection in Federated Learning [70.36925233356335]
  F2ED-LEARNING offers bidirectional defense against malicious centralized server and Byzantine malicious clients. F2ED-LEARNING securely aggregates each shard's update and launches FilterL2 on updates from different shards. evaluation shows that F2ED-LEARNING consistently achieves optimal or close-to-optimal performance.
  arXiv  Detail & Related papers  (2020-10-02T19:37:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.