The paper proposes a physics‑attested federated learning framework that uses process invariants—such as conservation of mass—to verify the integrity of model updates in collaborative anomaly detection for water infrastructure. By automatically mining these invariants from clean operational data, the authors create an admission gate that rejects fabricated telemetry while allowing honest contributions, and demonstrate its effectiveness across two physical testbeds (SWaT, WADI) and a benchmark (BATADAL). The approach also incorporates zero‑knowledge proofs to preserve data privacy while proving invariant compliance.
arXiv:2608. 01095v1 Announce Type: new Abstract: Federated learning (FL) enables multiple intelligent devices to collaboratively train a high-accuracy model without sharing raw data.
arXiv:2609.15521v1 Announce Type: new Abstract: Federated learning enables multiple parties to train a shared model without centralizing raw data with the help of an aggregator, but introduces integr...
arXiv:2609.37011v1 Announce Type: cross Abstract: Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into...
The paper investigates how privacy guarantees, robustness to Byzantine attacks, and detection coverage for rare intrusion types interact in federated network intrusion detection systems. It introduces geometric indistinguishability to explain how privacy noise can obscure minority-class signals, and demonstrates through experiments on UNSW‑NB15 that combining differential privacy with robust aggregation can disproportionately harm detection of rare attacks. The study highlights that these properties cannot be treated as independently composable and calls for aggregation‑aware modeling and sample‑aware evaluation to build trustworthy federated NIDS.
The paper investigates how multi‑step tool‑calling large language model agents can unintentionally create persistent billable state, allowing malicious or compromised tools to generate repeated charges without user credentials. It formalizes the persistent billable‑state boundary, identifies six denial‑of‑wallet attack vectors, and evaluates them with the DOW‑BENCH harness across six model families. The study shows significant cost amplification, demonstrates effective mitigation via deterministic history transformation and host‑side invariants, and highlights the scarcity of existing safeguards in real‑world repositories.
The paper proposes using lossy compression as a security signal in federated learning by defining a "compression footprint"—a low‑dimensional set of statistics derived from the compressor’s output. It introduces CRAFT, a server‑side aggregation method that leverages these footprints to distinguish honest from malicious updates without extra client metadata or knowledge of attacker numbers. Experiments on six attacks and datasets show CRAFT often outperforms existing robust aggregation baselines, demonstrating that compression can simultaneously reduce communication and enhance security.
The paper introduces Open-1B, a language model trained under a new fully auditable regime that ensures every training operation is reproducible on heterogeneous commodity hardware with bitwise certainty. By enforcing a fixed order on sources of nondeterminism—GPU reductions, data batch ordering, and inter/intra-node communication—the authors enable auditors to replay and verify individual training steps on a single machine. The release includes the full pretraining dataset, all intermediate checkpoints, the training codebase, and an audit harness for step-by-step verification.
arXiv:2609.22818v1 Announce Type: cross Abstract: Memory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely adv...
FedLNS is a server‑side framework that screens federated learning updates by representing each client’s contribution through changes in trainable normalization‑layer parameters, creating lightweight signatures that can be compared against a history‑aware cross‑client reference. The method requires no extra client‑to‑server communication, raw data, or labeled attack examples, and after screening, the remaining full‑model updates are aggregated with standard federated learning rules. Experiments on GPT‑style, BERT‑style, and LLaMA‑style models with 200 clients demonstrate that FedLNS achieves lower test perplexity than six baselines even when 40% of the population performs target manipulation under both IID and non‑IID data partitions.
The paper investigates privacy and integrity risks in federated fine‑tuning of a pretrained MobileNetV4 model on Quick, Draw! data. It shows that a single client update can reveal private labels, that label‑count recovery degrades with more clients, and that backdoor and label‑flipping attacks can succeed under FedAvg but are mitigated by FLTrust. The study also demonstrates a live poisoning session using Indigma’s FedMaestro orchestrator.
AuditFL introduces a contract-backed clearing layer that enables auditable federated learning in open settings by keeping training and aggregation off chain while recording only content identifiers and economic state on chain. Clients reserve update tickets with deposits, publish update identifiers, and claim refunds or rewards, while the task coordinator publishes global checkpoints and finalizes rounds through deterministic settlement rules. Experiments on MNIST with up to 200 clients show that AuditFL preserves the learning trajectory with manageable overhead and remains robust under stress tests, keeping accuracy changes within a few tenths of a percentage point.
The paper introduces DP‑BR‑FedAvg, a federated learning framework that combines Gaussian‑mechanism differential privacy with a coordinate‑wise trimmed‑mean Byzantine‑robust aggregation rule. It is evaluated on a simulated cross‑institutional classification task involving fraud and clinical‑risk scoring, where it improves the F1‑score for a minority class from 0.030 (plain FedAvg) to 0.119 while bounding privacy loss. The study demonstrates that privacy and robustness mechanisms interact, and that system design for regulated, adversarial, cross‑institutional settings must account for this interaction.