Abstract: Federated learning (FL) features two core advantages: keeping raw data local and enabling collaborative training across participants, which safeguards data privacy and facilitates distributed model collaboration. However, its architecture still confronts two key security threats—malicious client selection manipulation and server-side gradient tampering—rooted in the contradiction between distributed training and centralized aggregation. Specifically, malicious servers can rig client selection to skew the aggregated model, and the server’s absolute control over gradient aggregation creates a trust bottleneck for tampering, as client authentication relies on server trust and gradient aggregation lacks decentralized verification. To tackle these issues, this paper proposes a client-verifiable FL framework integrating Verifiable Random Functions (VRF) and lightweight Message Authentication Codes (MAC). In client selection, a VRF-based dynamic protocol ensures unforgeable participant identities and publicly verifiable selection results, preventing undetectable server tampering. In gradient aggregation, an innovative lightweight MAC mechanism with auxiliary node collaboration enables trustless tampering detection via gradient-sensitive parameters. Experiments demonstrate that the VRF-based selection maintains performance close to the theoretical benchmark of unmanipulated scenarios, reducing the malicious node selection rate by over 33% compared with traditional FedAvg. Meanwhile, the MAC-based gradient verification mechanism cuts communication overhead by around 24% relative to the baseline VerifyNet.

摘要： 联邦学习以原始数据不离开本地、跨参与方协同训练模型为核心优势，在保护数据隐私的同时推动了分布式场景下的模型协作，但这一架构仍面临客户端选择被恶意操纵与服务器梯度篡改的双重安全威胁。一方面，在开放网络环境中，恶意服务器会通过恶意操控客户端选择过程，导致聚合模型偏向攻击者预设的恶意方向。另一方面，在传统联邦学习架构中，服务器掌握梯度聚合的绝对控制权，因此作为联邦学习系统核心的服务器可能成为梯度篡改的信任瓶颈。这两类威胁本质上源于联邦学习的 “分布式训练 - 集中式聚合” 架构矛盾：客户端身份认证依赖服务器的信任假设，而梯度聚合过程缺乏去中心化的验证手段。为应对上述威胁，提出了融合可验证随机函数（VRF，Verifiable Random Function）与轻量级MAC（Message Authentication Code）的客户端可验证联邦学习框架。在客户端选择阶段，设计基于VRF函数的动态选择协议，利用其不可预测证明确保参与者身份的不可伪造性以及其选择过程的公开可验证性确保服务器无法篡改选择结果而不被发现；在梯度聚合阶段，创新性地引入辅助节点协同的轻量级MAC验证机制，通过梯度敏感参数实现无信任服务器的篡改检测。实验表明，在有恶意操纵服务器选择的情况下能够保证客户端的选择接近无操纵情况选择恶意客户端的理论值，VRF方法相较于传统的客户端选择（FedAvg）将恶意节点入选率降低了超过33%，同时梯度验证机制与基线方法VerifyNet相比通信开销下降了24%左右。