BIG DATA MINING AND ANALYTICS

ISSN 2096-0654 10/14 pp189−213

DOI: 10.26599/BDMA.2024.9020053
Volume 8, Number 1, February 2025

BPS-FL: Blockchain-Based Privacy-Preserving and

Secure Federated Learning

Jianping Yu, Hang Yao, Kai Ouyang, Xiaojun Cao, and Lianming Zhang*

Abstract: Federated Learning (FL) enables clients to securely share gradients computed on their local data with
the server, thereby eliminating the necessity to directly expose their sensitive local datasets. In traditional FL,
the server might take advantage of its dominant position during the model aggregation process to infer
sensitive information from the shared gradients of the clients. At the same time, malicious clients may submit
forged and malicious gradients during model training. Such behavior not only compromises the integrity of the
global model, but also diminishes the usability and reliability of trained models. To effectively address such
privacy and security attack issues, this work proposes a Blockchain-based Privacy-preserving and Secure
Federated Learning (BPS-FL) scheme, which employs the threshold homomorphic encryption to protect the
local gradients of clients. To resist malicious gradient attacks, we design a Byzantine-robust aggregation
protocol for BPS-FL to realize the cipher-text level secure model aggregation. Moreover, we use a blockchain
as the underlying distributed architecture to record all learning processes, which ensures the immutability and
traceability of the data. Our extensive security analysis and numerical evaluation demonstrate that BPS-FL
satisfies the privacy requirements and can effectively defend against poisoning attacks.

Key words: Federated Learning (FL); blockchain; privacy-preserving; model poisoning attack; Byzantine-
robustness

1 Introduction for traditional centralized machine learning has become

increasingly difficult with increased privacy protection
Artificial intelligence techniques[1] have shown
awareness and the emergence of data barriers among
tremendous advantages in areas, such as medical institutions. Recently, Federated Learning (FL)[5] has
prediction[2], natural language processing[3], and been extensively explored to enable a distributed
intrusion detection[4]. The exceptional efficacy of machine learning paradigm. As shown in Fig. 1, each
machine learning models hinges on the extensive client in FL has its local dataset and performs local
volumes of data. However, acquiring substantial data model training. During the training process, clients
only need to transmit the computed intermediate
Jianping Yu, Hang Yao, Kai Ouyang, and Lianming Zhang are
with College of Information Science and Engineering, Hunan parameters to the central server without disclosing their
Normal University, Changsha 410081, China. E-mail: local private dataset, which may contain sensitive
[email protected]; [email protected]; 202120293789 information. After receiving the intermediate
@hunnu.edu.cn; [email protected]. parameters from each participating client, the central
Xiaojun Cao is with Department of Computer Science, Georgia
server integrates these contributions to refine and
State University, Atlanta 30303, USA. E-mail: [email protected].
enhance the global model. This characteristic has
* To whom correspondence should be addressed.
Manuscript received: 2024-04-08; revised: 2024-07-22; garnered significant attention from both academia and
accepted: 2024-08-16 industry, contributing to the progress in the

© The author(s) 2025. The articles published in this open access journal are distributed under the terms of the
Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/).
 190 Big Data Mining and Analytics, February 2025, 8(1): 189−213

attacks.
To study the model poisoning attacks, researchers
Central server
have proposed various aggregation rules, such as
Krum[17], Detox[18], Trimmed-mean, and Median[19].
Global model Global model Global model
These rules aim to eliminate malicious gradients by
analyzing the distribution of gradients or by ranking
them. For instance, the Median rule uses the median of
Local model 1 Local model 2 Local model K
… local model updates from clients as the direction for
Client 1 Client 2 Client K
global model updates. However, the robustness of these
Local database 1 Local database 2 Local database K rules is not always reliable, and there is evidence that
algorithms, like Krum and Trimmed-mean, can be
Fig. 1 Framework of FL.
susceptible to poisoning attacks[20]. It is important to
development of FL. note that defense strategies against poisoning attacks
While FL has excellent potential in large-scale often require access to local gradients, which could
distributed training, current systems may be threatened result in information leakage. This conflict between
by certain privacy and security risks[6, 7]. Although the privacy protection and poison attack detection makes
training data of each client are not directly exposed to establishing a secure FL system challenging.
the server, the model updates are exposed to the servers Additionally, FL schemes that rely on central
and may be to the public. This means that attackers aggregators might face the issue of single-point
could reconstruct or infer the original training data by failures, further threatening the robustness of the FL
analyzing the model updates uploaded by clients, system.
leading to privacy leakage[8, 9]. In addition, the In recent years, many researchers have proposed
decentralized architecture of FL could expose the solutions to privacy and security issues. For example,
system to model poisoning attacks. The server cannot Cao et al.[21] developed an FL framework, named
directly access the clients’ datasets and the joint FLTrust, to counteract poisoning attacks. This
training process, which allows malicious clients to framework utilizes a small and clean root dataset, and
potentially submit crafted gradients or maliciously employs cosine similarity to identify malicious
modify local data labels, severely impacting the gradients. However, its privacy measures during model
performance of the federated model[10]. updates are relatively weak. To address the privacy
To effectively protect clients’ privacy and prevent shortcomings in FLTrust, Dong et al.[22] designed
data leakage, strategies, such as Secure Multi-party FLOD. FLOD uses a dual-server approach to protect
Computation (SMC)[11, 12], Homomorphic Encryption privacy during the aggregation phase and replaces the
(HE)[13, 14], and Differential Privacy (DP)[15, 16], have cosine similarity used in FLTrust with Hamming
been proposed. SMC ensures privacy and accurate distance to prevent poisoning attacks better. However,
computation through multiple interactions with clients, FLOD does not address the issue of single points of
but it requires significant communication costs and failure in distributed systems like blockchain networks.
demands clients to be constantly online. DP has the Ma et al.[23] proposed a scheme called Differential
capability of preventing data reconstruction by Privacy Byzantine-robust Federated Learning
injecting noise into gradient parameters, yet balancing (DPBFL). DPBFL combines differential privacy with
privacy protection with model quality remains a RSA aggregation rules, which can defend against
challenge in deep learning tasks. Compared to SMC Byzantine attacks while protecting privacy. However,
and DP, HE allows for accurate aggregation of the introduction of noise in DPBFL adversely affects
gradients and permits clients to drop out during the global model’s accuracy.
training. It is worth noting that such privacy protection To effectively counteract poisoning attacks on
mechanisms may increase the difficulty of identifying servers in FL and prevent potential malicious
model poisoning attacks, as malicious gradients behaviors, we propose an innovative Blockchain-based
become difficult to observe or detect in ciphertext (e.g., Privacy-preserving and Secure Federated Learning
from HE), providing cover for model poisoning (BPS-FL) scheme. This scheme can effectively detect
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 191

and defend against poisoning behaviors during joint 2 Related Work

training while ensuring client privacy. In BPS-FL, we
utilize threshold Paillier homomorphic encryption In this section, we briefly discuss the key research
technology that allows computations on encrypted data, work related to this paper and analyze the differences
where the results remain encrypted, enabling the secure between the existing solutions and the proposed
aggregation and analysis of local gradients without solution.
violating any client privacy. To further resist model 2.1 Secure FL
poisoning attacks, we have established a federated
Google proposed FL in 2016 to improve input
learning committee, composed of multiple members
prediction on mobile devices, such as keyboard
who are responsible for interacting with the server and
suggestions and voice recognition, while preserving the
executing protocols to obtain weighted scores of each
user’s privacy[24]. In FL, aggregation schemes, such as
client’s local gradients without compromising their
FedAvg and FedSGD[5], are susceptible to model
privacy. These weighted scores can be used to identify
poisoning attacks. Model poisoning attacks can be
and penalize malicious client behaviors. By taking
broadly divided into two main categories based on their
advantage of the inherent features of blockchain, such
attack targets: untargeted attacks and targeted attacks.
as transparency, immutability, and traceability, we
The primary purpose of untargeted attacks[25, 26] is to
have designed a blockchain mechanism to store the
weaken the overall availability of the global model,
model update information of all participating clients.
causing it to make incorrect predictions for a wide
Compared to the centralized federated learning where
range of test samples, thus reducing the model’s
clients communicate directly with a central server, this
mechanism not only removes the dependency on a general performance and trustworthiness. In contrast,
single server and provides a trustworthy record for targeted attacks[27, 28] are more precise, aiming to
model contributors, but also effectively prevents compromise the predictive integrity of the global
potential malicious tampering with the server, as well model in specific scenarios. Attackers carefully design
as avoiding the risk of a single point of failure. Our their attacks, so that the model makes incorrect
main contributions include: judgments with certain types of inputs while
● We propose BPS-FL scheme. This scheme maintaining high prediction accuracy with other types
leverages the distributed architecture of blockchain to of inputs. Such selective disruption is intended to
enable traceability at any time and mitigate the risk of influence specific decisions or actions without raising
single-point failures. widespread suspicion.
● We develop a Byzantine-robust aggregation To effectively defend against poisoning attacks
protocol that incorporates threshold Paillier encryption launched by malicious clients, researchers have
to safeguard clients’ privacy. This innovative approach designed various complex aggregation rules to increase
aims to neutralize the effects of malicious gradients the robustness of distributed learning systems.
and ensure the security of model aggregation at the Blanchard et al.[17] proposed a Byzantine-robust
ciphertext level. distributed stochastic gradient descent algorithm called
● Finally, we conduct a systematic evaluation Krum. The Krum algorithm ingeniously computes the
focusing on training accuracy and Byzantine Euclidean distance between the local gradient of each
robustness. The results show that our scheme client and the local gradients of all other clients, using
successfully meets the goals of high fidelity, reliability, the sum of these distances as a distance score. During
and security. the model update process, the system selects only the
The rest of the paper is organized as follows. Section updates from clients with the lowest distance scores to
2 presents the related work. Section 3 discusses the serve as the basis for the global model update. Building
preliminaries. Section 4 describes the system model on Krum, the Multi-Krum algorithm further improves
and design goals. In Section 5, we provide a detailed fault tolerance by not only searching for the single
description of the BPS-FL system design. Sections 6 best-scoring update but also selecting a set of the
and 7 conduct the security analysis and performance lowest-scoring gradient updates from all submissions.
evaluation respectively. Finally, we conclude the paper Specifically, the algorithm continuously selects the
in Section 8. lowest-scoring updates until a specified number of h
 192 Big Data Mining and Analytics, February 2025, 8(1): 189−213

local gradients have been accumulated. Once h local predictive accuracy of the model while ensuring a
gradients are selected, they are averaged to form the higher level of privacy. Li et al.[32] proposed ChainFL,
final global gradient update. This method allows the which uses a chain structure and secure multi-party
algorithm to withstand more outliers during the computation to aggregate client gradient updates
aggregation process, thus significantly enhancing the securely. The core of ChainFL is its innovative chain
model’s robustness while maintaining its accuracy. communication mechanism, which effectively reduces
Similarly, Yin et al.[19] proposed two aggregation rules: the risk of privacy leakage due to multiple
Median and Trimmed-mean. The Median method communications while reducing the computational and
reduces the impact of extreme values by taking the communication burden. Miao et al.[33] introduced the
median of each parameter from the local model updates CAFL model, which focuses on reducing
submitted by all clients. The Trimmed-mean method communication costs in large-scale FL deployments.
sorts all submitted updates by parameter value, By compressing local model updates and integrating
removes the extremes, and calculates the mean of the adaptive differential privacy, the CAFL model
remaining values for the global model update, aiming enhances client-side data protection, reduces
to mitigate the impact of outliers. Mhamdi et al.[29] bandwidth requirements, and provides flexible levels of
introduced the Bulyan method, a refined strategy that privacy protection under different privacy budgets. Xu
combines the principles of Krum and Trimmed-mean. et al.[34] proposed VerifyNet, which is a secure and
The Bulyan algorithm first applies the Krum rule to verifiable federated learning framework that combines
filter out a set of gradient updates and then aggregates homomorphic encryption and secret sharing techniques
them using the Trimmed-mean rule. This two-stage to ensure the confidentiality of local gradient updates
selection greatly enhances the algorithm’s resistance to and the security of the overall training process. The
complex attack patterns, ensuring that the global VerifyNet provides a novel verification mechanism
model’s updates maintain a high level of credibility that allows participants to verify the correctness of the
and accuracy even in highly adverse environments. aggregated results, thereby enhancing the
However, all these methods mentioned above involve trustworthiness of the system.
sending clients’ local updates directly to the server in However, the above approaches have limitations in
the form of plaintext model updates. On the server side, mitigating the risks posed by malicious or
these updates are analyzed and processed to be compromised clients who may deliberately transmit
incorporated into the global model. Such a model erroneous model updates, attempt to compromise the
update process presents notable privacy risks as the integrity of the global model or engage in various
clients’ model updates may contain sensitive data. forms of adversarial attacks.
2.2 Private FL 2.3 Secure and private FL
In the context of FL, privacy is an evolving area of Privacy and security issues in FL have increasingly
research, particularly in preventing the central server attracted attention in recent research. So et al.[35]
from misusing client dataset information. Bonawitz et introduced the first innovative framework, Byzantine
al.[30] innovated FL by introducing a protocol based on Robust Secure Aggregation (BRSA), to address
secure multi-party computation, which uses Secret challenges in ensuring data privacy and model
Sharing (SS) and secure aggregation to ensure privacy robustness in secure federated learning. The core
during model training. Their work maintains data concept of BRSA is that each client not only
confidentiality and provides a robust method against independently updates its local model but also interacts
dishonest participants and network failures. Truex with all other clients to verify and ensure the accuracy
et al.[31] extended FL’s privacy capabilities by and security of the updates. In the BRSA framework,
designing a new FL scheme combining differential each client uses homomorphic encryption to calculate
privacy and secure multi-party computation. This the distance between its local model update and those
scheme introduces differential privacy noise into the of other clients while keeping the data encrypted. This
model updates to prevent inference attacks on the mechanism allows clients to detect and eliminate
sensitive data of individual participants. The critical outliers in model updates without revealing the
contribution of this method is that it can maintain a specifics of the update. Subsequently, the client sends
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 193

the encrypted model updates and the calculated baseline dataset, there is a potential issue: If the sample
distances to the central server for aggregation. size of the baseline dataset is limited, its data
Although the BRSA framework effectively addresses distribution can hardly align perfectly with the local
privacy protection and Byzantine fault tolerance issues, training samples of each client. This inconsistency in
it relies on a central server to coordinate and aggregate distribution may cause global model updates to deviate
all users’ local updates. This means that if the central from the optimal update direction that accurately
server fails, the entire federated learning process will reflects the client data distribution. In other words, if
be disrupted. This reliance on a single server the root dataset differs significantly from the client data
architecture inevitably introduces a single point of distribution, then even if the gradients uploaded by the
failure risk. Liu et al.[36] proposed a Privacy-Enhanced clients are not malicious, the global model may fail to
Federated Learning (PEFL) framework based on linear accurately capture the actual characteristics of the
HE and packing techniques, which uses two non- client data, thereby affecting the performance of the
colluding servers and the Pearson correlation final model. Shayan et al.[40] proposed a system called
coefficient to facilitate the detection of malicious Biscotti. Biscotti combines the principles of blockchain
gradients. Nevertheless, PEFL cannot prevent server- and cryptography to allow decentralized multi-party
side malicious behaviors and single-point failures. machine learning while preserving privacy. Biscotti
Zhao et al.[37] proposed a framework called SEAR, protects the privacy of participants by introducing
which combines the trusted execution environment of differential privacy and multi-layer cryptographic
Intel SGX with efficient aggregation algorithms to promises while employing Byzantine fault-tolerant
protect privacy while resisting Byzantine attacks. aggregation algorithms (e.g., Multi-Krum) to defend
against malicious attacks. Although the introduction of
However, this implementation is highly dependent on
noise may adversely affect the global accuracy of the
specific hardware and such centralized design is prone
model, Biscotti avoids single points of failure through a
to a single point of failure. Zhang et al.[38] introduced
decentralized blockchain structure, ensuring a robust
SAFELearning, an algorithm that supports backdoor
and scalable system.
detection and privacy-preserving aggregation. The
In this paper, we propose BPS-FL scheme. BPS-FL
approach randomly divides participants into several
adopts blockchain technology as the distributed
sub-groups. It securely aggregates a sub-model for
architecture for FL, where all learning processes can be
each subgroup to filter out malicious sub-models rather
recorded in an immutable ledger, thereby preventing
than individual models. However, when there are fewer
malicious behaviors. Table 1 highlights the features of
members in a subgroup, the privacy protection level of
the proposed BPS-FL scheme and some
the participants decreases. If there are too many
aforementioned FL solutions.
members in a subgroup, it becomes easier for an
attacker to hide their malicious models within honest 3 Preliminary
models. Moreover, the study also suggests revealing
In this section, we introduce the preliminaries related to
some parameters of the sub-models, which raises a new
FL and threshold homomorphic encryption.
trade-off issue between privacy and security. Miao
et al.[39] proposed a new type of Privacy-preserving 3.1 Federated learning
Byzantine-robust Federated Learning scheme, called FL is a state-of-the-art distributed machine learning
PBFL. PBFL employs a new aggregation rule to defend framework that enables the training of algorithms on
against poisoning attacks in FL while using multiple decentralized edge devices or servers. In FL,
homomorphic encryption to ensure the privacy of client the local data samples are not exchanged, which helps
data. The aggregation rule is inspired by the design in preserving privacy and reducing communication
principle of FLTrust, where the server maintains a overhead. This framework eliminates the need for
small, sanitized baseline dataset to generate reliable clients to send sensitive data to a central repository.
baseline gradients, thereby assessing whether the Instead, clients contribute to the learning process by
gradient updates from clients could be maliciously computing and sharing model updates in the form of
tampered with. Although the scheme enhances the gradients derived from their local dataset. We consider
model’s ability to counter poisoning attacks with the a network of N clients, collectively represented as
 194 Big Data Mining and Analytics, February 2025, 8(1): 189−213

Table 1 Comparison between our work and previous imbalanced data. The aggregated gradient produces a
works. global gradient, which is used to update the global
Scheme Fun1 Fun2 Fun3 Fun4 model parameters to W t+1 using a suitable learning
[17]
Blanchard et al. Yes ✘ Single No rate η .
Yin et al.[19] Yes ✘ Single No
Cao et al.[21] Yes ✘ Single No 3.2 Threshold Paillier encryption
[29]
Mhamdi et al. Yes ✘ Single No Homomorphic encryption is a type of encryption that
Miao et al.[39] No DP Single No enables computations to be performed on ciphertexts.
Xu et al.[34] No Secret sharing Single No The encrypted result obtained from these computations
So et al.[35] Yes Secret sharing Single No can be decrypted to match the result of the same
Liu et al.[36] Yes Paillier Dual No operations performed on the plaintext. This unique
[37]
Zhao et al. Yes Intel SGX Single No feature allows data to remain encrypted throughout the
Zhang et al.[38] Yes Secret sharing Single No processing phase, making it a valuable tool for
Shayan et al.[40] Yes DP Single Yes enhancing privacy and security in different
Ours Yes Paillier Single Yes computational environments. The commonly used
Notes: Fun1 : It denotes whether resisting poisoning attacks or homomorphic encryption algorithms currently include
not, Fun2 : It denotes whether providing privacy protection or Paillier[41], Cheon−Kim−Kim−Song (CKKS)[42], and
not, Fun3 : It denotes whether single server or dual server, and Somewhat Homomorphic Encryption (SHE)[43].
Fun4 : It denotes whether capable of preventing single-point
failures or not. Paillier encryption supports efficient additive
homomorphic operations. In contrast, the main
C = {C1 , C2 , . . . , C N } . Each client Ci has a private advantage of CKKS and SHE lies in their support for
dataset Di , where i ranges from 1 to N . The multiplicative homomorphic operations, though this
collaborative training process between the central typically results in higher computational and storage
server and clients involves multiple rounds, each overhead. For applications that only require additive
consisting of the following key phases: homomorphic operation, Paillier encryption is more
● Global model synchronization: The process efficient. The core procedures of the Paillier encryption
scheme can be summarized as follows:
begins with the central server distributing the latest
● Paillier.KeyGen (p, q) → (pk, sk) : The input
version of the global model, denoted as W , to all
parameters p and q are two large primes and p , q .
participating clients. This step ensures that each client
The public key pk is n = p · q , the private key sk is
starts training with the latest model, maintaining
(p, q) , and λ = lcm (p − 1, q − 1) , where lcm ( ) is the
consistency across the network.
least common multiple function. A positive integer
● Local training: During each iteration t , the clients
g = 1 + n ∈ Z∗n is chosen, such that µ=
engage in local model training. Each client Ci receives (L(gλ mod n2 ))−1 mod n exists, where Z∗n denotes the
the current global model W t and uses its dataset Di to multiplicative group of modules n , L (x) = (x − 1)/n ,
perform the training. The objective is to optimize the mod means modulo operation, x denotes a variable.
model by minimizing a predefined loss function, which ● Paillier.Enc (m, pk) → [[m]]pk : Given a plaintext
measures the prediction error of the model. After m ∈ Zn , a randomly chosen r is chosen to satisfy
training, each client computes the gradient of the loss 1 ⩽ r < n and gcd (r, n) = 1 , where gcd ( ) is the greatest
function with respect to the model parameters, common divisor function, Zn denotes the set of
resulting in a local gradient. This gradient contains the integers modulo n . the ciphertext is generated:
necessary updates based on the client’s unique dataset [[m]]pk = (n + 1)m × rn mod n2 .
and is securely transmitted to the central server to ● Paillier.Dec ([[m]]pk , sk) → m : For a ciphertext
protect the confidentiality of the raw data. [[m]]pk ∈ Z∗n , the plaintext can be obtained as
● Model aggregation: The central server aggregates m = L (cλ mod n2 ) · µ mod n , where c is ciphertext.
the local gradients received from all clients. This The (Z, T ) threshold Paillier encryption[44] has not
aggregation is performed according to predefined rules, only additive homomorphism but also threshold
which may include methods such as simple averaging properties. Each party holds a uniform public key pk ,
or more complex strategies to mitigate the effects of while the private key is split into Z shares
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 195

(sk1 , sk2 , . . . , skZ ) , which requires the cooperation of at participant possessing only a portion of the decryption
least T participants for the cooperative decryption. The key. This threshold decryption mechanism enhances
procedure of threshold Paillier encryption is as follows: the security and fault tolerance of the system and
● T-Paillier.KeyGen (p, q) → (pk, sk) : Two large ensures that cryptographic models from clients can be
prime numbers p and q are randomly picked first and securely aggregated, thus effectively protecting client
let n = pq , then two more primes p′ , q′ that satisfy privacy.
p = 2p′ + 1 , q = 2q′ + 1 , and gcd (n, φ (n)) = 1 , are
4 Problem Formulation
identified, φ (n) is the Euler function. Let n′ = p′ · q′ ,
and choose a random β ∈ Z∗n , (a, b) ∈ Z∗n × Z∗n . Let In this section, we present the system model, the threat
g = (1 + n)a · bn mod n2 , θ = a · n′ · β mod n . The public model, and design goals.
key pk consists of n, g , and θ , and the private key
4.1 System model
sk = n′ · β . This private key sk is further partitioned via
the Shamir secret sharing scheme to obtain Figure 2 illustrates the architecture of the proposed
(sk1 , sk2 , . . . , skZ ) . Specifically, t−1 values BPS-FL, which is a novel integration of FL with
(a1 , a2 , . . . , at−1 ) are randomly chosen among blockchain technology designed to enhance data
∑
{0, 1, . . . , n · n′ − 1} and a polynomial f (x) = t−1i=0 ai · x
i privacy and model security across a distributed
is constructed, where a0 = sk . The secret share received network. The system model consists of five major
by the i -th participant is ski = f (i) mod n · n′ . entities, each with a distinct role in the federated
● T-Paillier.Enc (m, pk) → [[m]]pk : Given a plaintext learning process:
m , a number r ∈ Z∗n is chosen randomly, and the ● Key Generation Center ( KGC ): KGC is the
plaintext is encrypted using the public key pk as trusted entity responsible for generating and
distributing system keys for clients and committee
follows:
members. These keys ensure that sensitive information,
[[m]]pk = gm · rn mod n2 (1) such as local model updates, is protected throughout
● T-Paillier.ShareDec ([[m]]pk , ski ) → [[m]]i : The the learning process.
participant holding the secret share ski gets the ● Clients: Clients are the nodes in the network that
decryption share by own local datasets. All authorized clients possess the
( )
same pair of asymmetric keys pkx, skx provided by
[[m]]i = [[m]]2Z!sk
pk
i
mod n2 (2) KGC. In iteration t , each client Ci computes locally on
● T-Paillier.CollaborativeDec (Q, pk) → m : If the set its dataset Di to generate the local gradient Gti . To
Q receives at least T decryption shares, collaborative protect the privacy of the local dataset during the
decryption can be performed to obtain the plaintext m , learning process, clients encrypt the local gradients
( ) using the committee’s public key. The encrypted
∏ Q
2µ0,
m=L [[m]] j j
mod n × 4Z!12 θ mod n
2
(3) gradients are sent to the blockchain network for
j∈Q
storage.
∏ ′
where Q
µ0, = Z! × j′ ∈Q\{ j} −j j ∈ Z , Q denotes set of
j
● Cloud Server ( CS ): CS serves as an aggregator in
participants involved in the cooperative decryption the BPS-FL system. Its main role is to collect
process, j is the index of the current participant, and j′ encrypted gradients from all participating clients and
is the index of other participants in set Q except j. calculate the updated global model. Additionally, the
Given two ciphertexts [[m1 ]]pk and [[m2 ]]pk , and a CS collaborates with the committee to mitigate and
constant l ∈ Zn , the homomorphic property can be defend against potential model poisoning attacks.
described as ● Committee ( COMM ): Members of COMM are
blockchain nodes that are set by default in the system
[[m1 ]]pk · [[m2 ]]pk = [[m1 + m2 ]]pk (4) and do not accept external registrations. The number of
members is set based on the number of all participating
[[m1 ]]lpk = [[l · m1 ]]pk (5)
nodes. The initial COMM is authorized based on their
When multiple ciphertext computations are involved, social entity reputation value. Each member of the
Threshold Paillier encryption allows multiple committee possesses a public key pkc generated by
participants to jointly decrypt the data, with each KGC and their own secret share skci . They are
 196 Big Data Mining and Analytics, February 2025, 8(1): 189−213

Public/Private key

Key generation center

Committee

Intermediate
result
Encrypted
intermediate result

Block

Block

Block
Encrypted global model Public/
Private key

Smart contract

Encrypted
global model

Encrypted Encrypted
intermediate result gradient vector Honest Honest
client client

Honest Malicious Malicious

Cloud server client client client

Fig. 2 BPS-FL system model.

responsible for the collaborative decryption of (3) Local gradient encryption and uploading: The
encrypted data, and cooperate with CS to implement client computes the local gradient locally and then uses
secure defense strategies. the committee’s public key pkx to encrypt it and
● Blockchain system: The blockchain stores some upload it to the blockchain, thus protecting its privacy
encrypted intermediate results of the cloud server’s during transmission.
interaction with the committee as well as the encrypted (4) Aggregation and weight calculation of
local gradients and encrypted global models. The encrypted gradients: CS downloads all encrypted
encrypted intermediate results mainly include local gradients from the blockchain and utilizes the
obfuscated encrypted gradients and encrypted model additive property of homomorphic encryption to
updates. In addition, all clients jointly maintain the compute the difference between each client’s local
blockchain ledger. Therefore, the blockchain provides gradient and the average gradient. To protect the
a secure and reliable storage and verification privacy of the clients, CS performs multiple rounds of
mechanism for FL. This means that no entity can deny communication with COMM to compute the weight
its submitted updates, and any malicious attempts to scores of each local gradient. The results of these
tamper with stored data can be detected. computations are stored on the blockchain.
In our system, the entities carry out steps roughly as (5) Global model generation and re-encryption:
follows: CS aggregates the encrypted local gradients based on
(1) Key generation and distribution: At the the weight scores to obtain an encrypted global
beginning of the FL task, KGC generates and gradient. CS communicates with COMM to protect the
distributes keys for the clients and the committee. Each client’s privacy while obtaining a global model
client gets the same pair of public and private keys encrypted with the client’s public key pkx and saves it
( )
pkx, skx for encrypting and decrypting messages. to the blockchain.
(2) Initialization and encryption: CS initializes the To improve the system’s security and credibility, the
global model and encrypts it using the client’s public clients, the CS, and the COMM all need to pay a
key pkx . The encrypted global model is uploaded to the certain deposit using the smart contract.
blockchain. All authorized clients can decrypt the
global model from the blockchain using the private key 4.2 Threat model
skx . CS and COMM are assumed not to collude with each
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 197

other. They are characterized as “curious but honest” is the global model before the attack, and W ∗ is the
entities, indicating that they faithfully carry out the global model after the attack.
tasks established by the protocol but may be driven by In the BPS-FL, we focus on the following potential
curiosity to extract or infer additional information. It is threats:
important to note that, in practice, CS and COMM may (1) Data leakage: The local gradients of a client can
engage in such curious behavior driven by commercial reflect the statistical characteristics of their local
interests and attempt to access clients’ private data. dataset, which attackers might exploit to leak data and
That means its members are semi-trustworthy. In BPS- obtain sensitive raw data.
FL, we have defined two types of clients: honest client (2) Poisoning attacks: Malicious clients may
and malicious client. conduct poisoning attacks on the global model by
Definition 1 (Honest client) An honest client Ci uploading carefully crafted gradient updates, causing
refers to those who upload an unbiased estimate of the the model to learn inaccurate information and thus
true gradient Gi calculated on their private dataset Di reducing its performance.
in accordance with the protocol. (3) Inference attacks: During the aggregation of
The main goal of these clients is to jointly optimize local updates to update the global model, CS and
and enhance the performance of the global model by COMM need to exchange some intermediate
contributing true local gradient updates. computational results. Malicious entities might exploit
Definition 2 (Malicious client) A malicious client this exchange process to extract or infer sensitive
Ci∗ refers to those who may be controlled by attackers information, further violating client privacy.
and upload harmful gradients to compromise the
4.3 Design goals
accuracy of the FL model.
Malicious clients may intentionally submit distorted Our goal is to develop a blockchain-based privacy-
gradients in order to execute precise model poisoning preserving and secure federated learning scheme that
attacks or contribute arbitrary gradients to compromise can ensure data privacy while effectively defending
the precision of the global model. Although these against model poisoning attacks from malicious clients.
malicious clients have their own datasets containing To achieve this goal, the proposed scheme must
potentially poisoned datasets, they are unable to integrate Byzantine fault-tolerance mechanisms to
directly access the local datasets of other honest clients. enhance system robustness while ensuring data
They can access the encrypted global model and privacy. Furthermore, we strive to design a scheme
decrypt it, but they cannot independently observe the that, while ensuring security, can achieve or approach
model updates of honest clients. Moreover, malicious the accuracy level of standard federated learning
clients may collude, amplifying the impact of their algorithms, like Federated Averaging (FedAvg) or
attacks by sharing strategies and objectives. They are Federated Stochastic Gradient Descent (FedSGD). Our
capable of launching targeted or Untargeted attacks to scheme focuses on security and privacy protection
disrupt the learning process of the model. through blockchain and homomorphic encryption.
In response to such behavior, we propose the Distinct from FedAVG, where the entire set of model
definition of a model poisoning attack: parameters is sent to the server for aggregation to form
Definition 3 (Model poisoning attack) A model a global model, in FedSGD, only gradients are
poisoning attack is a strategy where a malicious client transmitted each time. The server averages these
Ci∗ uploads poisoned gradients to manipulate and gradients and subsequently updates the global model. It
misdirect the update process of the global model, is relatively straightforward to implement, control
thereby reducing the model’s performance. variables in experiments, and employ it as a benchmark
The objective of malicious clients is to solve the model to verify the security and robustness of the
following optimization problem: scheme. To this end, our FL scheme is designed to
argmax S (W − W ∗ ) (6)
achieve the following three core design goals:
Wi ∈ [1, N]
● Fidelity. The scheme must ensure that the
where S represents the transposed column vector of the accuracy of the global model is not compromised.
signs of the global model updates before the attack, W Specifically, we aim to train a highly accurate global
 198 Big Data Mining and Analytics, February 2025, 8(1): 189−213

model equivalent to FedSGD, with privacy protection Algorithm 1 Setup

provided by carefully designed optimization Input: (1) Large prime numbers p, q, p̂, and q̂ ;
algorithms. (2) N clients {C1 , C2 , . . . , C N } ;
● Security. The scheme should satisfy dual security (3) Committee {COMM1 , COMM2 , . . . , COMMK } .
goals: (1) protect the privacy of client data during Output: System keys pkx, skx, pkc, skc1 , skc2 , . . . , skcK .
model training, preventing data leakage and inference 1: /*Key distribution*/
of sensitive information by other participants; and (2) 2: KGC generates ( pkx, skx ) ← Paillier.KeyGen (p, q) ;
design effective mechanisms to resist malicious 3: KGC generates ( pkc, skc ) ← T-Paillier.KeyGen ( p̂, q̂) ;
attacks, ensuring that malicious clients cannot 4: skc is split into K shares (skc1 , skc2 , . . . , skcK ) using Shamir
influence the accuracy of the global model by secret sharing technique;
submitting anomalous gradients. 5: for Ci ∈ [1, N] ∈ C do
● Reliability. The scheme should ensure that all 6: Ci ← (pkx, skx) ;
operations in the FL system are reliably recorded, and 7: end for
the behavior of all participating entities can be 8: KGC distributes pkc and skci to COMMi ∈ [1, K] ;
comprehensively and accurately tracked and audited, 9: /*Global model upload*/
thus maintaining the transparency and fairness of the 10: CS initializes global model W init ;
system. 11: [[W init ]]pkx ← Paillier.Enc (W init , pkx) from CS;
5 System Design 12: CS sends [[W init ]]pkx to blockchian;
13: return pkx, skx, pkc, skc1 , skc2 , . . . , skcK .
In this section, we present the technical details of the
setup phase, local training phase, and robust
committee’s private key generates a secret share via the
aggregation phase in BPS-FL. Table 2 presents the
Shamir secret sharing technique, which is then
main notations and symbols used.
distributed to each member of the committee. Since
5.1 Setup phase individual members may try to tamper with data or
perform malicious operations, and key leakage or
During the setup phase as shown in Algorithm 1, KGC
destruction may also occur, the security of the entire
performs key distribution, and CS uploads the initial
system will be threatened if it relies only on a single
global model to the blockchain.
member for decryption, and it also faces the risk of a
(1) Key distribution: KGC generates the same pair
single point of failure. By requiring multiple members
of asymmetric keys for Paillier homomorphic
to participate in decryption, the threshold mechanism
encryption for all authorized clients, and generates the
can effectively prevent the malicious behavior of a
public and private keys of threshold Paillier
single member and also prevent the single point of
homomorphic encryption for the committee. The
failure problem. Therefore, the committee can
Table 2 Involved notations. collaboratively decrypt the ciphertext only if the owned
Notation Description secret share is not less than T .
pkx Public key of the client (2) Model upload: At the beginning of the FL task,
skx Private key of the client CS first randomly initializes the parameters of the
pkc Public key of the committee global model, denoted as W init . To protect the privacy
skci Private key share of COMMi of the model, CS encrypts W init with the public key pkx
Di Training dataset of the client Ci of the participating clients. The encryption ensures that
Wt Global model at iteration t
only authorized clients can decrypt and use the global
Gti Local gradient of client Ci at iteration t model. Once the encryption is complete, CS uploads
Ḡt Average gradient at iteration t
the encrypted global model [[W init ]]pkx to the
dti Distance vector of the client Ci at iteration t blockchain. As a decentralized platform, the
dit Distance value of the client Ci at iteration t
blockchain ensures the safety of the global model as
σ (d̂it ) Weight of the local gradient of client Ci at iteration t
data storage and protects it from unauthorized access
[[m]]pk Ciphertext of plaintext m encrypted with public key pk
during the federated learning process, providing a
η Learning rate
collaborative and secure environment for the
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 199

participants. training, client Ci initiates the process by decrypting

the encrypted global model [[W t ]]pkx using the
5.2 Local training phase
Paillier.Dec function. The decrypted model parameters
During the local gradient training phase, clients are are then used by client Ci to perform computations on
responsible for learning and uploading their model its own dataset Di , resulting in an updated local
training results locally. Specifically, each client first gradient as
downloads the t -th round securely encrypted global
Gti = ∇L (W t , Di ) (7)
model from the blockchain. After decrypting the
encrypted global model using its own private key skx , Central to these computations is the empirical loss
the clients get the plaintext of the global model and can function ∇L (W t , Di ) , which quantifies the divergence
train on their own dataset. In this process, the clients between the global model predictions and the actual
use the Stochastic Gradient Descent (SGD) algorithm observations in Di . The gradient operator ∇ is critical
to optimize the model parameters to get local gradient in directing the optimization process, indicating how
updates. After the training is completed, the clients do the model weights should be changed to minimize the
not directly disclose their training results. To prevent loss function, and thus improve the predictive accuracy
potential data leakage and protect personal privacy, the of the model.
clients encrypt the locally updated models. This step (2) Gradients upload: To ensure the confidentiality
critically ensures the confidentiality and integrity of the of data during the t -th training iteration, the client
information during the upload process. Finally, the needs to encrypt the model parameters before
encrypted training results are securely uploaded back to uploading the local gradients to the blockchain.
the blockchain, awaiting further aggregation and global Specifically, the client needs to encrypt the local
gradient [[Gti ]]pkc with the public key pkc of the
model updates. As shown in Algorithm 2, each client
conducts the following steps: committee by calling the function T-Paillier.Enc ,
where [[Gti ]]pkc = {[[gti1 ]]pkc , [[gti2 ]]pkc , . . . , [[gtiz ]]pkc } and gt
(1) Local training: During the t -th iteration of
denotes the element in the local gradients, and z is the
Algorithm 2 Local_Training dimension of the local gradient. It is worth noting that
Input: (1) Client Ci ∈ [1, N] ; malicious clients may launch model poisoning attacks.
(2) Local training dataset Di ∈ [1, N] ; They can craft poisonous local gradients and encrypt
(3) Local learning rate η ; them using public keys, then send these encrypted
(4) Local epochs e ; poisonous gradients to the blockchain. If the CS
(5) System keys skx and pkc . unconsciously integrates these poisonous gradients and
Output: Encrypted local gradients. updates the global model, it may lead to a decrease in
1: /*Local model training*/ model performance, or even make the model
2: for Ci ∈ [1, N] ∈ C do completely ineffective, posing a threat to the security
3: Ci get the global model [[W t ]]pkx from blockchain; and effectiveness of the entire system. Therefore,
W t ← Paillier.Dec ([[W t ]]pkx , skx) ;
encryption provides concealment for model poisoning
4:
attacks. To efficiently identify and process these
5: for j ∈ [1, e] do
encrypted poisonous gradients, CS employs a series of
6: Take a random batch D′ from samples Di ;
7: /*Gradient descent*/
multiple rounds of interactions with COMM. These
interactions occur within a carefully designed security
8: Gti ← ∇L (W t , D′ ) ;
protocol that aims to minimize the adverse effects of
9: W t+1 ← W t − ηGti ; poisonous gradients on the global model.
10: end for
5.3 Robust aggregation phase
11: [[Gti ]]pkc ← T-Paillier.Enc (Gti , pkc) ;
12: /*Gradient upload*/ In this phase, CS needs to extract all encrypted local
gradients from the blockchain and utilize them for
13: Ci sends [[Gti ]]pkc to blockchain;
14: end for
model aggregation. If CS decrypts these local gradients
directly, the client’s privacy may be violated. To
15: return [[Gti ]]pkc .
address this, we design a protocol with Byzantine-
 200 Big Data Mining and Analytics, February 2025, 8(1): 189−213

robust aggregation, where CS and COMM interact to the distance vector [[dit ]]pkc by the ciphertext [[ri ]]pkc of
perform secure aggregation of models at the ciphertext a randomly sampled value to achieve obfuscation,
level while effectively preventing malicious clients
[[ x̄it j ]]pkc = [[xit j ]]pkc · [[ri ]]pkc (10)
from poisoning attacks. We compute the deviation of
each client’s local gradient from the average gradient We represent the result of multiplying [[xit j ]]pkc and
and determine the weight of each local gradient in the [[ri ]]pkc as [[ x̄it j ]]pkc . The encrypted vector [[Rti ]]pkc =
aggregation based on this deviation. In this way, we {[[ x̄i1
t ]]
pkc , [[ x̄i2 ]]pkc , . . . , [[ x̄iz ]]pkc } is processed in this
t t

can effectively weaken the impact of malicious manner and then sent to the blockchain for subsequent
gradients. distance calculations. The steps involved in Algorithm
(1) Distance calculation: CS gets the encrypted 3 illustrate this process.
local gradients {[[Gti ]], i ∈ [1, N]} uploaded by the (b) Decryption and squares summation: The
clients from the blockchain. We use {[[Gti ]]pkc }i=N
i=1 to algorithm downloads and processes obfuscated
denote the set of N local gradients. The encrypted encrypted vectors from the blockchain. Its primary
average gradient can be computed according to the responsibility is to implement a collaborative
additive homomorphic property of the Paiilier decryption process by calling the functions
algorithm of Eqs. (4) and (5), T-Paillier.ShareDec and T-Paillier.CollaborativeDec .
 N  N1 The goal is to recover the plaintext value of each
∏  ∏
N
1
[[Ḡ ]]pkc =  [[Gi ]]pkc  =
t t
[[ Gti ]]pkc (8) element in the encrypted vector [[Rti ]]pkc . Note that the
i=1
N i=1
success of the decryption operation relies on the secret
Equation (9) calculates the distance between the local shares held privately by at least T committee members,
gradient and the average gradient for each client, where which ensures the security and distributed nature of the
ḡt denotes the element in the average gradient, decryption. Once decryption is complete, the algorithm
[[dit ]]pkc =[[Gti ]]pkc · [[Ḡt ]]−1
pkc =
calculates the sum of the squares of each element in the
{[[gti1 ]]pkc · [[ḡt1 ]]−1 t −1 Rti vector. To further protect the privacy of the data, the
pkc , [[gi2 ]]pkc · [[ḡ2 ]]pkc , . . . ,
t
committee must re-encrypt the sum of squares using
[[gtiz ]]pkc · [[ḡtz ]]−1
pkc } =
the T-Paillier.Enc function and the committee’s public
{[[gti1 − ḡt1 ]]pkc , [[gti2 − ḡt2 ]]pkc , . . . , [[gtiz − ḡtz ]]pkc }
key. This step prevents any possible data leakage
(9)
during data transfer and storage. Finally, these
Similar to the previous notation for sets of local
encrypted sum of squares are sent to the blockchain for
gradients, we use {[[dti ]]pkc }i=N i=1 to denote a set of storage. Algorithm 4 provides detailed steps for this
distances, where each element represents the distance
process.
of the local gradient from the average gradient for each
client. Here, it is important to specify that dti is a Algorithm 3 Preprocessing and obfuscation
vector. In order to obtain the l2 -norm of the vector Input: Encrypted distance vectors {[[d1t ]]pkc , [[d2t ]]pkc , . . . ,
without directly revealing dti , we propose the security [[dNt ]]pkc } .
protocol SecDist. Specifically, we assume that Output: Obfuscated distance vectors {[[Rti ]]pkc }i=N i=1 .
[[dti ]]pkc = {[[xi1
t ]]
pkc , [[xi2 ]]pkc , . . . , [[xiz ]]pkc }
t t
and four 1: for i = 1 to N do
algorithms are designed into the protocol, each of { }
2: [[dit ]]pkc = [[xi1
t ]]
pkc , [[xi2 ]]pkc , . . . , [[xiz ]]pkc ;
t t
which plays its own role to ensure modularity and
3: /*Randomly select a nonzero integer ri */
clarity throughout the safe distance calculation process.
4: for j = 1 to z do
Below are the specific roles of each algorithm:
(a) Preprocessing and obfuscation: This algorithm 5: [[ x̄it j ]]pkc = [[xit j ]]pkc · [[ri ]]pkc = [[xit j + ri ]]pkc ;
is responsible for the preprocessing and obfuscation of 6: end for
{ }
the input encrypted distance vectors. Its main function 7: [[Rti ]]pkc = [[ x̄i1
t ]]
pkc , [[ x̄i2 ]]pkc , . . . , [[ x̄iz ]]pkc ;
t t

is to introduce randomness to maintain the encryption 8: end for

state and protect the privacy of the original data during
9: Send {[[Rti ]]pkc }i=N
i=1 to blockchain;
subsequent calculations. The specific steps involve
multiplying the ciphertext [[xit j ]]pkc of each element in 10: return {[[Rti ]]pkc }i=N
i=1 .
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 201

Algorithm 4 Decryption and square summation that leverage the homomorphic properties of
Input: Obfuscated distance vectors {[[Rt1 ]]pkc , [[Rt2 ]]pkc , ..., encryption, enabling mathematical operations to be
[[Rti ]]pkc } . performed on encrypted data without revealing any
Output: A set of encrypted squared sums {[[Sumti ]]pkc }i=N original information. Once these homomorphic
i=1 .
1: for i = 1 to N do calculations are completed, the encrypted distance
values are sent to the blockchain in preparation for the
2: Download [[Rti ]]pkc from blockchain;
final decryption step. The steps involved in this process
3: for j = 1 to T do
are described in Algorithm 5.
4: [[Rti ]] j ← T-Paillier.ShareDec ([[Rti ]]pkc , skc j ) ; (d) Final decryption and distance calculation: The
5: end for algorithm is responsible for downloading the final
j=T
6: Rti ← T-Paillier.CollaborativeDec ({[[Rti ]] j } j=1 , pkc) ; encrypted distance value from the blockchain. Similar
to the previous decryption, this process also requires
7: /*Sum the elements in Rti */
( )2 ( )2 ( )2 the secret shares held by at least T committee members
8: t
Sumti = x̄i1 + x̄i2
t + · · · + x̄iz
t
; to collaboratively decrypt and calculate the final
9: [[Sumti ]]pkc ← T-Paillier.Enc (Sumti , pkc) ; distance value. After decryption, the algorithm
10: end for performs a square root operation on the decrypted
distance values to recover the original measurements.
11: Send {[[Sumti ]]pkc }i=N
i=1 to blockchain;
These measurements are then uploaded to the
12: return {[[Sumti ]]pkc }i=N
i=1 . blockchain for storage, and can be used directly in
subsequent weight calculations. It is worth noting that
(c) Encrypted distance generation: This algorithm the privacy of these distance values does not need to be
performs further processing on the previously protected. Even if the distance values are disclosed to
calculated encrypted sum of squares. The specific the public, the client’s privacy is not compromised.
operation involves multiplying the encrypted sum of The relevant steps are shown in Algorithm 6.
squares [[Sumti ]]pkc and [[2 · ri · Σxiz + z · ri2 ]]−1
pkc to The security protocol SecDist is formed by
eliminate noise and calculate the final encryption combining these four algorithms into one. Each
distance value [[dit ]]pkc . That’s because algorithm is an independent module. CS and COMM
call the corresponding algorithm to complete specific
∑
z
t 2
( x̄i1 ) +( x̄i2
t 2
) + · · · + ( x̄izt )2 = (xit j + ri )2 = tasks, while ensuring the security and privacy of the
j=1 entire protocol. Algorithm 7 describes the SecDist
∑
z [ ] protocol. Additionally, Fig. 3 provides the sequence
(xit j )2 + 2ri xit j + ri2 = diagram of SecDist.
j=1
(2) Weight calculation: We assign a weight to each
∑
z
t 2
(xi1 ) + (xi2
t 2
) + · · · + (xizt )2 + 2ri xit j + zri2 (11)
local gradient to mitigate the effect of malicious
j=1 gradients. This weight depends on how far the client’s

Equation (11) is expressed in homomorphic Algorithm 5 Encrypted distance generation

encryption as Input: A set of encrypted squared sums {[[Sumti ]]pkc }i=N
i=1 .

[[Sumti ]]pkc = [[(xi1

t 2
) + (xi2 ) + · · · + (xizt )2 +
t 2 Output: Encrypted distance values {[[dit ]]pkc }i=N
i=1 .
1: /*Remove the random noise ri */
∑ z
2ri xit j + zri2 ]]pkc (12) 2: for i = 1 to N do
j=1
3: Download [[Sumti ]]pkc from blockchain;
In order to get the distance value, we have 4: [[dit ]]pkc = [[(xi1
t )2 + (xt )2 + · · · + (xt )2 ]]
pkc =
i2 iz

[[dit ]]pkc = [[(xi1

t 2
) + (xi2
t 2
) + · · · + (xizt )2 ]]pkc = [[Sumti ]]pkc · [[2ri Σxiz + zri2 ]]−1
pkc ;

[[Sumti ]]pkc · [[2ri Σxiz + zri2 ]]−1

pkc (13) 5: end for

6: Send {[[dit ]]pkc }i=N

i=1 to blockchain;
Note that the distance dit is a value and not a vector.
7: return {[[dit ]]pkc }i=N
i=1 .
This process involves a series of arithmetic operations
 202 Big Data Mining and Analytics, February 2025, 8(1): 189−213

Algorithm 6 Final decryption and distance calculation

Input: Encrypted distance values {[[dit ]]pkc }i=N .
{ } i=1
Output: Distance values d1 , d2 , . . . , dN .
t t t
Cloud server Committee
1: for i = 1 to N do Preprocessing and obfuscation

2: Download [[dit ]]pkc from blockchain;

Decryption and squares summation
3: for j = 1 to T do
SecDist Encrypted distance generation
4: [[dit ]] j ← T-Paillier.ShareDec ([[dit ]]pkc , skc j ) ;
5: end for Final decryption and distance calculation
j=T
6: dit ← T-Paillier.CollaborativeDec ({[[dit ]] j } j=1 , pkc) ;
√
7: dit ← dit ; Time Time
8: end for
Fig. 3 Sequence diagram of interaction between CS and
9: Send {dit }i=N
i=1 to blockchain;
COMM.
10: return {d1t , d2t , . . . , dN
t }.
the above steps, we can calculate how much each
client’s local gradient deviates from the average
Algorithm 7 SecDist
gradient. Finally, we normalize {d̂it }i=N
i=1 using the
Input: Encrypted distance vectors {[[d1t ]]pkc , d2t ]]pkc , . . . ,
Softmax function, which is described as
[[dNt ]]pkc } .
{ }
e−d̂i
t
Output: Distance values d1 , d2 , . . . , dN .
t t t
σ (d̂it ) =
1: CS: ∑
N −d̂t (15)
e j
j=1
2:Preprocessingandobfuscation ([[d1t ]]pkc , d2t ]]pkc , . . . , [[dNt ]]pkc )
t
→ {[[Rti ]]pkc }i=N
i=1 ; After normalization, a smaller value of d̂i indicates
3: COMM: that the client’s training dataset and model updates are
4: Decryption and squares summation ({[[Rti ]]pkc }i=N
i=1
)→ more accurate and reliable and should be given a
{[[Sumti ]]pkc }i=N
i=1 ; higher weight. Conversely, a larger value of d̂it
5: CS: indicates that the client’s local gradient is significantly
6: Encrypted distance generation ({[[Sumti ]]pkc }i=N
i=1
)→ different from the average gradient, which could be due
{[[dit ]]pkc }i=N
i=1 ; to the uniqueness of its dataset or intentionally
7: COMM: uploaded abnormal gradients by malicious clients. In
8: Final decryption and distance calculation ({[[dit ]]pkc }i=N ) such cases, a lower weight should be assigned. The
i=1
→ {dit , di+1
t , . . . , dt } ; influence of malicious gradients can be effectively
{ N
}
d
9: return i i+1
t , dt , . . . , dt
N .
controlled, and the robustness of the model can be
enhanced through the adjustment of weights.
(3) Model update: After obtaining a set of weights
local gradient deviates from the average gradient. First,
{σ (d̂it )}i=N
i=1 , CS updates the global model as
CS obtains the distance between the client’s local
gradient and the average gradient in the blockchain, N σ (d̂ t )G t
∑ i i
W t+1 ← W t − η
and we assume dt = {dit , di+1 i=1 ∑
t , . . . , dt } N (16)
N . The malicious σ (d̂tj )
clients may upload local gradients with large j=1

magnitudes to amplify their impacts, which can cause Algorithm 8 shows the proposed security protocol
the average gradient to deviate from the normal range. SecAgg, which enables secure aggregation without
t
Therefore, we take the median value of dt to dmed and making Gti public. Specifically, using the additive
compute homomorphic property of homomorphic encryption,
CS is able to compute the ciphertext [[W t+1 ]]pkc of the
d̂it = |dit − dmed
t | (14)
global model, as shown in Line 3. Next, CS multiplies
We use d̂it as a criterion for similarity. According to this encrypted global model with the ciphertext of the
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 203

Algorithm 8 SecAgg Algorithm 9 BPS-FL

Input: (1) Local gradients {[[Gti ]]pkc , [[Gti+1 ]]pkc , . . . , [[GtN ]]pkc } ; Input: (1) Client Ci ∈ [1, N] ;
(2) Local training dataset Di ∈ [1, N] ;
(2) Weights {σ (d̂it ), σ (d̂i+1
t ), . . . , σ (d̂ t )} ;
N
(3) Local learning rate η ;
t
(3) Global model [[W ]]pkc ;
(4) Local epochs e ;
(4) Systems keys pkx, pkc, skc1 , skc2 , . . . , skcK .
(5) Global epochs E .
Output: Encrypted global model.
Output: Encrypted global model.
1: CS: 1: KGC distributes system keys & CS initializes global models
2: /*Model update*/ using Setup ( · );
∏N σ (d̂it )Gti −1
2: for i = 1 to E do
3: [[W t+1 ]]pkc = [[W t ]]pkc · ( i=1 [[η ∑Nj=1 σ (d̂t ) ]]pkc ) ;
j 3: for i = 1 to N do
4: /*Randomly select a nonzero integer r′ */ 4: Ci calls Local_Traing ( Di , η, e );
5: [[R]]pkc = [[W t+1 ]]pkc · [[r′ ]]pkc ; 5: end for
6: Send [[R]]pkc to blockchain; 6: CS downloads {[[Gti ]]pkc }i=N
i=1 from blockchain;
7: COMM:
7: CS obtains encrypted distance vectors {[[dti ]]pkc }i=N
i=1 by Eqs.
8: Download [[R]]pkc from blockchain; (8) and (9);
9: for j = 1 to T do SecDist ({[[dti ]]pkc }i=N ) → {dit , di+1
t , . . . , dt } ;
8: i=1 N
10: [[R]] j ← T-Paillier.ShareDec ([[R]]pkc , skc j ) ; t
9: CS get the median dmed of {dit , di+1
t , . . . , dt } ;
N
11: end for
10: for i = 1 to N do
j=T
12: R ← T-Paillier.CollaborativeDec ({[[R]] j } j=1 , pkc) ;
CS computes d̂i = |di − dmed | ;
t t t
11:
13: [[R]]pkx ← Paillier.Enc (R, pkx) ; 12: end for
14: Send [[R]]pkx to blockchain; 13: CS calculates weights {σ (d̂it ), σ (d̂i+1
t ), . . . , σ (d̂ t )} by
N
15: CS:
Eq. (15);
16: Download [[R]]pkx from blockchain;
14: SecAgg ({[[Gti ]]pkc }i=N , {σ (d̂it )}i=N , [[W t ]]pkc )→ [[W t+1 ]]pkx ;
17: /*Remove the random noise r′ */
i=1 i=1
15: end for
18: [[W t+1 ]]pkx = [[R]]pkx · [[r′ ]]−1
pkx ; 16: return [[W t+1 ]]pkx .
19: Send [[W t+1 ]]pkx to blockchain;
20: return [[W t+1 ]]pkx . the federated learning task starts. If any entity
misbehaves, the relevant evidence can be submitted to
randomly sampled value r and sends the result, which the blockchain, and then its deposit will be forfeited.
is the obfuscated value, to the blockchain. Then,
6 Theoretical Analysis
COMM can download these values from the
blockchain and collaboratively decrypt them, encrypt In this section, we analyze the security of BPS-FL as
the decrypted values with the client’s public key pkx , well as its computational and communication
and upload the ciphertext to the blockchain. CS can complexity.
download the ciphertext, apply the additive
6.1 Security analysis
homomorphic property to remove the noise, and obtain
the ciphertext [[W t+1 ]]pkx for the global model, which The functional privacy and semantic security of Paillier
will be uploaded to the blockchain in Lines 18 and 19. homomorphic encryption and threshold Paillier
Algorithm 9 shows the overall processes of the homomorphic encryption are building blocks for the
proposed BPS-FL. In BPS-FL, the training process strong security in BPS-FL. In this section, we present a
ends when the client’s objective function converges. hybrid argument[44] that utilizes a simulator to further
Otherwise, the client repeats the subsequent execution demonstrate BPS-FL does not disclose any sensitive
of the local training phase, as well as the robust information about the local gradient.
aggregation phase by CS and COMM. It is worth Definition 4 (BPS-FL security) Given a security
noting that the clients, CS and COMM have to submit a parameter κ , an arbitrary subset of clients C and
κ
certain amount of deposit to the smart contract before G = {CS, COMM} . Let REALC, G be the random
 204 Big Data Mining and Analytics, February 2025, 8(1): 189−213

variable representing the joint view of the parties to G [[ξt ]]pkc and [[θi ]]pkc are used to change the inputs of the
of the above protocol during its actual execution. BPS- protocol SecAgg executed by CS and COMM. Since
FL security holds if there exists a Probabilistic only the content of the ciphertext is changed, the IND-
Polynomial Time (PPT) simulator SIM , and the output CPA security of HE and the two non-colluding CS and
of SIM is computationally indistinguishable from COMM settings ensure that the hybrid is
κ
REALC, G , indistinguishable from the previous hybrid.
κ κ Hyb5: In this hybrid, we use [[ξt+1 ]]pkc · [[ζ]]pkc instead
REALC, ≡ SIMC, ,
G G of [[W t+1 ]]pkc · [[r]]pkc to re-encrypt the parameters. Even
where “ ≡ ” means computationally indistinguishable. though COMM can decrypt the above ciphertext, the
Theorem 1 (Data confidentiality) Based on hybrid has the same distribution as [[W t+1 + r]]pkc .
Paillier security, BPS-FL achieves security according Therefore, this hybrid is indistinguishable from the
to Definition 4. previous one.
Proof We use a standard hybrid argument to prove Combining all the above hybrid from 1 to 5, we
this theorem. Our aim is to show that the joint view of conclude that there exists a simulator SIM sampled
κ
the output of SIM is indistinguishable from REALC, G . from the above distributions, making its output
Our argument is divided into several consecutive parts, computationally indistinguishable from that of REAL .
denoted by Hybi . In each part, we make some safe ■
modifications so that we can prove the computational
6.2 Complexity analysis
indistinguishability.
Hyb1: In this hybrid, we initialize a series of random To evaluate the efficiency of BPS-FL, we analyze the
variables whose distribution is indistinguishable from communication and computation overhead of BPS-FL.
κ
the joint view REALC, G
G of the parties in .
Let N denote the number of clients, z denote the
Hyb2: In this hybrid, we change the behavior of dimension of the local gradient, T tr denote the time
simulated honest clients Ci ∈ C . Each Ci client encrypts overhead of local model training, T enc denote the time
a randomly chosen vector βi using the public key pkc overhead of homomorphic encryption, T dec denote the
instead of the original local gradient Gti . Under the time overhead of homomorphic decryption, and T mul
decision composite residual assumption, since we only denote the time overhead of multiplication.
change the content of the ciphertext, the two non- During the local training phase, each client Ci trains
colluding CS and COMM cannot distinguish the view its own local gradient using the local training dataset
of βi from the view of Gti using the and then encrypts its own local gradient [[Gti ]]pkc .
INDistinguishability under Chosen Plaintext Attack Therefore, its computational cost increases linearly
(IND-CPA) security property of HE. Thus the IND- with the number of model parameters during the
CPA security property of HE ensures that the hybrid is training and encryption processes, which is
indistinguishable from the previous hybrid. O (T tr + zT enc ) . The communication complexity is
Hyb3: In this hybrid, we simulate CS using [[θi ]]pkc O (z|Xenc |) , where |Xenc | is the communication
instead of [[dit ]]pkc to change the input for CS and complexity of the encrypted numbers. In the SedDist
COMM to execute the SecDist protocol, where θi is a process, the complexity mainly depends on the number
randomly chosen vector. At the same time, instead of of clients N and the dimension of the local gradient z .
[[x]]pkc · [[r]]pkc , we simulate CS perturbing θi with a The computational complexity is O (N · z (T dec + T mul ))
random uniformly sampled noise ζi . Since the and the communication complexity is O (4N · z |Xenc |) .
parameters added by the uniform random numbers are In the SedAgg process, the computational complexity is
also uniformly random, and the noise ζ is sampled O (z (T enc + T dec + T mul )) and the communication
from the same uniform distribution, they have the same complexity is O (3z |Xenc |) .
stochastic properties. The IND-CPA security property
7 Performance Evaluation
of HE, as well as the two non-colluding CS and
COMM settings ensure that the hybrid is In this section, we present the evaluation of our
indistinguishable from the previous hybrid. proposed BPS-FL through a series of experiments on
Hyb4: In this hybrid, instead of [[W t ]]pkc and [[Gti ]]pkc , real datasets. The experimental setup consisted of a
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 205

machine running the Ubuntu 20.04 operating system, potentially compromise the data integrity of machine
powered by an Intel (R) Xeon (R) Platinum 8338C learning models. To simulate an untargeted attack, we
CPU clocked at 2.60 GHz and complemented by an randomly relabel local training samples held by
NVIDIA RTX 3090 GPU for enhanced computational malicious clients to the wrong classes, then use these
performance. relabeled samples to generate local poisonous
gradients. To replicate the targeted attack, malicious
7.1 Experimental setup
clients deliberately mislabel data samples from class
(1) Dataset and settings: To evaluate the performance “1” to class “7”, ensuring that there are no
of BPS-FL, we conduct experiments using four well- misclassifications for other classes, thereby generating
known datasets: MNIST, Fashion MNIST, CIFAR-10, poisonous gradients.
and CIFAR-100. The MNIST dataset serves as a (3) FL settings: In our evaluation, we employ the
benchmark in the realm of machine learning, cross-entropy loss function within a cross-silo
comprising a collection of 60 000 training samples and federated learning setup. Specifically, we set the
10 000 test samples of handwritten digits ranging from number of clients to n = 10 , selecting all clients for
0 to 9, each represented as a 28 by 28-pixel grayscale participation during each iteration of the training
image. The Fashion MNIST dataset, providing a process. To train the model, we consider four distinct
comparable structure to MNIST, increases the architectural structures. Firstly, depending on the
complexity by featuring grayscale images across 10 content complexity of the dataset, we utilize a
distinct categories of fashion items, such as shirts, MultiLayer Perceptron (MLP) structure, which consists
sweaters, and skirts. Additionally, the CIFAR-10 of three fully connected layers with Relu activation
functions to ensure the capacity for non-linear
dataset introduces a broader set of 60 000 32 pixel ×
expression. The detailed architecture of the MLP is
32 pixel color images, divided into 10 classes with
presented in Table 3. Secondly, we consider a
6000 images each, offering a more challenging
Convolutional Neural Network (CNN) structure,
scenario for image recognition. The CIFAR-100
composed of two convolutional layers followed by a
dataset is further subdivided into 100 fine-grained
fully connected layer, designed to capture the spatial
classes on CIFAR-10, and the similarity between hierarchical features of image data. The specific
image classes is higher, which puts higher architecture of the CNN is delineated in Table 4. For
requirements on the model feature extraction
capability. Table 3 MLP architecture for MNIST.
Serial Number of
To simulate the blockchain environment integral to Layer Value
number params
our BPS-FL, we use the Ganache tool to orchestrate a 1 Input (784, ) 0
local private Ethereum blockchain network. Ganache is 2 FC1 (784, 256) 200 960
specifically tailored for blockchain development and 3 Relu – 0
testing, offering a streamlined and accessible platform 4 FC2 (256, 128) 32 896
for emulating the complex dynamics of a blockchain 5 Relu – 0
network. The smart contracts, which are central to our 6 FC3 (128, 10) 1290
BPS-FL system, are implemented using Solidity—a
statically typed programming language designed for Table 4 CNN architecture for FashionMNIST.
creating smart contracts that run on the Ethereum Serial Number of
Layer Value
Virtual Machine (EVM). Solidity’s syntax, similar to number params
1 Input (1, 28, 28) 0
JavaScript, facilitates the crafting of complex
2 conv1 (1, 16, 3, 1, 1) 160
contractual agreements within the blockchain.
3 Relu – 0
Moreover, our BPS-FL system’s machine learning
4 maxpool (2, 2) 0
training model is constructed utilizing the advanced
5 conv2 (16, 32, 3, 1, 1) 4640
capabilities of PyTorch 1.13.0—a leading open-source
6 Relu – 0
machine learning library—and Python 3.10.
7 maxpool (2, 2) 0
(2) Poisoning attacks in BPS-FL: In our research,
8 flatten (1568, ) 0
we explore two typical types of poisoning attacks:
9 FC1 (1568, 10) 15 690
untargeted attacks and targeted attacks. These attacks
 206 Big Data Mining and Analytics, February 2025, 8(1): 189−213

2.5 2.5
the more complex CIFAR-10 and CIFAR-100 datasets, FedSGD FedSGD
2.0 2.0
we trained with the standard ResNet-18 and VGG-16 BPS-FL BPS-FL
1.5 1.5

Test loss
Test loss
models to take advantage of their deep structure for
richer image features. 1.0 1.0

For the MNIST and FashionMNIST datasets, we 0.5 0.5

evenly distribute the data samples among each client, 0 10 20 30 40 50 0 10 20 30 40 50

with each client handling approximately 6000 samples Number of epochs Number of epochs
(a) MNIST MLP (b) MNIST CNN
to ensure a balanced data distribution. For the CIFAR-
2.5 2.5
10 and CIFAR-100 datasets, we process about 5000 FedSGD FedSGD
2.0 BPS-FL 2.0 BPS-FL
samples per client to ensure a balanced data
1.5 1.5

Test loss
Test loss
distribution. Additionally, we set the number of global
1.0 1.0
iterations to epoch = 50 , allowing the model sufficient
0.5 0.5
training iterations to learn the features of the data. The
learning rate is established at η = 0.001 , a setting 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs
intended to balance training speed with convergence
(c) FashionMNIST MLP (d) FashionMNIST CNN
performance, thereby avoiding issues like gradient
explosion or vanishing during the training phase. The Fig. 4 Convergences of the proposed BPS-FL and FedSGD
use of the cross-entropy loss function enables us to on MNIST and FashionMNIST datasets.
quantify the discrepancy between the probability 6 6
FedSGD FedSGD
distribution of the model’s output and the actual label 5 BPS-FL 5 BPS-FL
distribution, thereby guiding the model to adjust its
Test loss

Test loss
4 4
parameters more effectively throughout the iterations. 3 3

7.2 Experimental results 2 2

1 1
(1) Fidelity evaluation: To validate the fidelity 0 10 20 30 40 50 0 10 20 30 40 50
performance of our proposed scheme, we conduct a Number of epochs Number of epochs
(a) CIFAR-10 VGG (b) CIFAR-10 RESNET
comparative analysis with FedSGD[5] and BPS-FL. In 6 6
this series of experiments, the possibility of model FedSGD FedSGD
5 BPS-FL 5 BPS-FL
poisoning attacks is not considered. We perform tests
Test loss

Test loss

4 4
on four model structures: MLP, CNN, RESNET18, and
3 3
VGG16. Figures 4 and 5 display the convergence
2 2
comparison between BPS-FL and FedSGD on the
1 1
MNIST, FashionMNIST, CIFAR-10, and CIFAR-100 0 10 20 30 40 50 0 10 20 30 40 50
datasets. The results show that the convergence of our Number of epochs Number of epochs
(c) CIFAR-100 VGG (d) CIFAR-100 RESNET
scheme is very similar to that of FedSGD. Therefore,
regarding convergence, our scheme does not adversely Fig. 5 Convergences of the proposed BPS-FL and FedSGD
affect the performance of the model. on CIFAR-10 and CIFAR-100 datasets.
Additionally, to further examine the impact of our
our proposed solution exactly, we compare the defense
scheme on model accuracy, we compare the accuracy
effectiveness of BPS-FL with traditional FedSGD
of FedSGD with BPS-FL. Figure 6 illustrates the
accuracy outcomes of our proposed scheme and against both targeted and untargeted attacks under
FedSGD on the MNIST, FashionMNIST, CIFAR-10, scenarios involving malicious clients on several
and CIFAR-100 datasets. The comparison indicates distinct datasets. Specifically, we examine the
that there is no significant difference in accuracy performance of several approaches when the proportion
between our scheme and FedSGD, and our approach of malicious clients is set at 10%, 30%, and 50%.
maintains model accuracy while preserving model Figure 7 presents the accuracy comparison between our
convergence. In summary, the results confirm that our solution and FedSGD under untargeted attacks across
scheme achieves the goal of fidelity. these varying percentages of malicious clients. The
(2) Security evaluation: To evaluate the security of results indicate that at a lower proportion of malicious
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 207

100 FedSGD with a sharp drop in accuracy. In contrast, our solution

BPS-FL
demonstrates higher accuracy and enhanced robustness
80
against Byzantine attacks. The superiority of our
Accuracy (%)

60 approach stems from its core design, which utilizes a

median strategy as the baseline for accuracy, and
40
effectively assigns weights to each client’s local
20 gradient, thereby minimizing the negative impact
potentially brought about by malicious clients. This
0
method not only promotes the overall security of the
io IS LP

-1 10 T

00 T
N

R NN

IF RE G

G
E

E
IF MN ML
N CN

VG
M TM

IF FA SN

AR SN

model but also ensures the robustness and accuracy of

-1 T C

00 V
T
Fa nM T

E
IS

IS

AR IS

AR R-

-1

the model in highly uncertain attack environments.

N

0
M

I
io

Similarly, we present the comparison between our

C
sh

sh
Fa

scheme and FedSGD in a targeted attack scenario, as

Fig. 6 Accuracies of BPS-FL and FedSGD. shown in Fig. 8. The experimental results show that
there is no significant difference in accuracy between
clients, such as 10%, the accuracy of our solution is the two approaches. Specifically, the experiments
nearly indistinguishable from that of FedSGD. simulate a specific attack where a malicious client
However, as the proportion of malicious clients mislabels some of the data belonging to class “1” to
increases, especially reaching 50%, a significant class “7”. It is important to note that this attack is
degradation in performance is observed in FedSGD, limited to manipulating only a small subset of the
MNIST FashionMNIST CIFAR-10 CIFAR-100
100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)
70 70 70 BPS-FL MLP 70 BPS-FL MLP
BPS-FL CNN BPS-FL CNN
60 60 60 60
50 50 50 50
40 FedSDG MLP 40 FedSDG MLP 40 40
30 FedSDG CNN 30 FedSDG CNN 30 30
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(a) 10% malicious (b) 10% malicious (c) 10% malicious (d) 10% malicious

MNIST FashionMNIST CIFAR-10 CIFAR-100

100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)

70 70 70 BPS-FL MLP 70 BPS-FL MLP

60 60 60 BPS-FL CNN 60 BPS-FL CNN
50 50 50 50
40 FedSDG MLP 40 FedSDG MLP 40 40
30 FedSDG CNN 30 FedSDG CNN 30 30
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(e) 30% malicious (f) 30% malicious (g) 30% malicious (h) 30% malicious

MNIST FashionMNIST CIFAR-10 CIFAR-100

100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)

70 70 70 BPS-FL MLP 70 BPS-FL MLP

60 60 60 BPS-FL CNN 60 BPS-FL CNN
50 50 50 50
40 FedSDG MLP 40 FedSDG MLP 40 40
30 FedSDG CNN 30 FedSDG CNN 30 30
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(i) 50% malicious (j) 50% malicious (k) 50% malicious (l) 50% malicious

Fig. 7 Accuracies of the proposed BPS-FL and FedSGD under untargeted attacks.
 208 Big Data Mining and Analytics, February 2025, 8(1): 189−213

MNIST FashionMNIST CIFAR10 CIFAR100

100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)
BPS-FL MLP BPS-FL MLP
70 70 70 BPS-FL CNN 70 BPS-FL CNN
60 60 60 60
50 50 50 50
40 40 40 40
FedSDG MLP FedSDG MLP 30 30
30 FedSDG CNN 30 FedSDG CNN
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(a) 10% malicious (b) 10% malicious (c) 10% malicious (d) 10% malicious
MNIST FashionMNIST CIFAR10 CIFAR100
100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)
BPS-FL MLP 70 BPS-FL MLP
70 70 70 BPS-FL CNN BPS-FL CNN
60 60 60 60
50 50 50 50
40 FedSDG MLP 40 FedSDG MLP
40 40
30 FedSDG CNN 30 FedSDG CNN 30 30
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(e) 30% malicious (f) 30% malicious (g) 30% malicious (h) 30% malicious
MNIST FashionMNIST CIFAR10 CIFAR100
100 100 100 100
90 90 90 FedSDG MLP 90 FedSDG MLP
80 80 80 FedSDG CNN 80 FedSDG CNN
Accuracy (%)

Accuracy (%)

Accuracy (%)

Accuracy (%)
70 BPS-FL MLP 70 BPS-FL MLP
70 70 BPS-FL CNN BPS-FL CNN
60 60 60 60
50 50 50 50
40 FedSDG MLP 40 FedSDG MLP 40 40
30 FedSDG CNN 30 FedSDG CNN 30 30
20 BPS-FL MLP 20 BPS-FL MLP 20 20
10 BPS-FL CNN 10 BPS-FL CNN 10 10
0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(i) 50% malicious (j) 50% malicious (k) 50% malicious (l) 50% malicious

Fig. 8 Accuracies of the proposed BPS-FL and FedSGD under targeted attacks.

dataset, thus having a limited impact on the overall and Biscotti[40]. The analysis is performed on the
performance of the model. In addition, in Fig. 9, we MNIST and FashionMNIST datasets, using an MLP
analyze the Attack Success Rate (ASR), which model architecture and fixing the number of global
measures the proportion of samples that the attacker iterations at 50 for adequate model training. Table 5
successfully misleads into a specific error class. Our shows a comparison of the accuracy of different
scheme is consistently lower than FedSGD in terms of learning schemes under untargeted attacks. We observe
ASR, indicating its superior robustness against that when the proportion of malicious clients is 10%,
accuracy attacks. It is worth noting that despite the the performance of the other schemes is similar to the
challenges posed by malicious clients, our scheme BPS-FL approach. However, as the proportion of
leverages advanced defense strategies to effectively malicious clients increases, BPS-FL consistently
identify and mitigate the impact of malicious samples, outperforms the other approaches in accuracy,
thereby maintaining a high level of accuracy for the demonstrating its superior performance maintenance.
model. In addition, all data processing steps are In particular, at a malicious client ratio of 50% on the
performed in an encrypted environment, ensuring the FashionMNIST dataset, the accuracy of the other
privacy and security of the data while providing a schemes drops below 80%. At the same time, BPS-FL
strong guarantee for processing sensitive information. maintains an accuracy rate above this level,
(3) Comparative analysis: In our study, we conduct demonstrating its robustness in scenarios with a high
a comparative analysis of the BPS-FL scheme with proportion of malicious clients. In addition, Table 6
other federated learning approaches such as Krum[17], illustrates the accuracy performance of the schemes
Trimmed-mean[19], ChainFL[32], PEFL[36], PBFL[39] under targeted attack scenarios. The results show that
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 209

MNIST FashionMNIST CIFAR10 CIFAR100

6 6 100 100
FedSDG MLP FedSDG MLP FedSDG MLP FedSDG MLP
5 FedSDG CNN 5 FedSDG CNN 80 FedSDG CNN 80 FedSDG CNN
BPS-FL MLP BPS-FL MLP BPS-FL MLP BPS-FL MLP
4 4
ASR (%)

ASR (%)

ASR (%)

ASR (%)
BPS-FL CNN BPS-FL CNN BPS-FL CNN BPS-FL CNN
60 60
3 3
40 40
2 2
1 1 20 20

0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(a) 10% malicious (b) 10% malicious (c) 10% malicious (d) 10% malicious
MNIST FashionMNIST CIFAR10 CIFAR100
100 100 100 100
FedSDG MLP FedSDG MLP FedSDG MLP FedSDG MLP
80 FedSDG CNN 80 FedSDG CNN 80 FedSDG CNN 80 FedSDG CNN
BPS-FL MLP BPS-FL MLP BPS-FL MLP BPS-FL MLP
ASR (%)

ASR (%)

ASR (%)

ASR (%)
BPS-FL CNN BPS-FL CNN BPS-FL CNN BPS-FL CNN
60 60 60 60
40 40 40 40
20 20 20 20

0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(e) 30% malicious (f) 30% malicious (g) 30% malicious (h) 30% malicious

MNIST FashionMNIST CIFAR10 CIFAR100

100 100 100 100
FedSDG MLP FedSDG MLP FedSDG MLP FedSDG MLP
80 FedSDG CNN 80 FedSDG CNN 80 FedSDG CNN 80 FedSDG CNN
BPS-FL MLP BPS-FL MLP BPS-FL MLP BPS-FL MLP
ASR (%)

ASR (%)

ASR (%)

ASR (%)
BPS-FL CNN BPS-FL CNN BPS-FL CNN BPS-FL CNN
60 60 60 60
40 40 40 40
20 20 20 20

0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50 0 10 20 30 40 50
Number of epochs Number of epochs Number of epochs Number of epochs
(i) 50% malicious (j) 50% malicious (k) 50% malicious (l) 50% malicious

Fig. 9 Values of ASR of BPS-FL and FedSGD under targeted attack.

Table 5 Accuracies of different schemes under untargeted Table 6 Accuracies of different schemes under targeted
attack with different proportions of malicious clients (the attack with different proportions of malicious clients (the
best results are marked in bold). best results are marked in bold).
(%) (%)
MNIST FashionMNIST MNIST FashionMNIST
Algorithm Algorithm
10% 30% 50% 10% 30% 50% 10% 30% 50% 10% 30% 50%
Krum 93.02 89.82 88.09 82.28 81.14 79.61 Krum 92.97 92.84 92.98 81.84 82.08 82.33
Trimmed-mean 92.97 91.22 87.15 82.01 81.50 79.43 Trimmed-mean 93.00 93.09 92.92 82.44 82.29 81.98
ChainFL 93.11 86.32 80.57 82.13 75.73 61.23 ChainFL 92.85 89.83 87.66 80.79 79.21 77.43
Biscotti 92.57 89.79 87.35 81.09 80.46 79.23 Biscotti 92.77 92.43 92.13 81.23 81.09 79.88
PEFL 93.22 90.91 88.77 82.21 81.29 79.56 PEFL 92.95 92.85 92.26 82.42 82.23 82.22
PBFL 92.72 90.45 70.31 82.29 81.43 64.54 PBFL 93.22 93 92.22 82.85 82.27 82.39
Ours 93.11 91.83 89.40 82.21 81.97 80.62 Ours 92.77 93.21 93.03 82.30 82.44 82.41

BPS-FL maintains excellent performance even at not only validate the effectiveness of the BPS-FL
higher ratios of malicious clients, effectively scheme but also provide a robust safeguard for the
countering targeted attacks without significantly security of federated learning environments.
compromising the accuracy of the model’s output. Table 7 demonstrates that the proposed BPS-FL
Overall, the BPS-FL scheme demonstrates a significant approach significantly outperforms other comparative
advantage in defending against malicious attacks in schemes in terms of ASR under targeted attack. The
both untargeted and targeted scenarios. These results superiority of BPS-FL stems from its unique strategy to
 210 Big Data Mining and Analytics, February 2025, 8(1): 189−213

Table 7 Values of ASR of different schemes under targeted 300

attack with different proportions of malicious clients (the Encryption time
250 Decryption time
best results are marked in bold).
(%) 200

Time (s)
MNIST FashionMNIST
Algorithm 150
10% 30% 50% 10% 30% 50%
Krum 0.09 1.41 2.73 0 0.10 1.80 100

Trimmed-mean 0.26 1.15 3.08 0 0.30 1.50 50

ChainFL 0.73 1.95 10.23 1.45 2.54 3.24
0
Biscotti 0.18 1.43 4.12 0.21 0.76 1.51 MLP CNN
Model
PEFL 0.09 1.32 3.70 0 0.70 0.30
PBFL 0.26 1.06 9.25 0 0.40 2.50 Fig. 10 Encryption and decryption times.
Ours 0.09 0.88 1.94 0.10 0.10 0.20
comparison of the time cost for data encryption and
mitigate malicious attacks. The Krum algorithm selects decryption between the MLP model and the CNN
the most appropriate gradient vectors from all model. The specific data show that the MLP model
submissions for model updating and excludes the rest. requires 254.24 s for encryption and 117.54 s for
Such a method may discard valuable gradients decryption. In comparison, the CNN model requires
containing useful information during defense against only 22.69 s for encryption and 10.44 s for decryption.
malicious attacks, potentially ignoring data that could The significant difference observed is mainly due to
benefit model training, especially when attackers are the number of parameters and the complexity of the
numerous. In contrast, the Trimmed-mean approach network structure of the models. The time required for
updates the model by averaging the remaining encryption and decryption operations increases linearly
gradients after excluding a certain proportion of the with the number of parameters. Considering that the
highest and lowest vectors. Although this method number of parameters of the MLP model is 11.5 times
mitigates the impact of extreme values, it can still higher than the CNN model, it is natural that the MLP
result in the loss of important data by removing part of requires a longer time for both encryption and
the gradient information. Conversely, the BPS-FL decryption.
strategy uses a median-based aggregation approach that In an experimental setup using a CNN model with a
effectively reduces the influence of malicious gradients variable number of client participants, we conduct a
on global model updates while integrating more detailed evaluation of the processing time required for
participating parameters. This approach significantly distance computation, weight computation, and model
improves model robustness to a high proportion of updating during the robust aggregation phase. As
malicious clients by preserving useful information. In shown in Fig. 11, the time cost for distance and weight
addition, all computational processes within the BPS- computation shows a clear linear increase with the
FL scheme are performed in ciphertext, ensuring addition of more client participants in the computation.
privacy and further protecting the system from single- 500
point server failures and potential malicious tampering Calculating distance and weight
Updating model
by recording all learning outcomes on a blockchain. 400
Overall, these designs not only maintain model
300
Time (s)

performance but also significantly improve data

security and system reliability. 200
(4) Evaluation of processing time: We evaluate the
time efficiency of the data encryption and decryption 100
processes on the client side. To ensure data security
0
during transmission, we implement the Paillier 2 4 6 8 10
Number of client participants
encryption algorithm and set its security parameter to a
length of 2048 bits to maintain high-security standards. Fig. 11 Processing time of one iteration of BPS-FL in the
Under this configuration, Figure 10 demonstrates a robust aggregation phase.
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 211

This trend can be attributed to the SecDist algorithm, Foundation of China (No. 62472170), the Hunan
where the computational cost is directly proportional to Provincial Natural Science Foundation of China (Nos.
the number of client participants. Specific data show 2021JJ30455, 2022JJ30398, and 2022JJ40277), the
that with only two client nodes involved, the time Hunan Provincial Degree and Postgraduate Teaching
required to compute distances and weights is 86.25 s. Reform Research Project of China (No. 2023JGSZ060),
However, as the number of client nodes increases to and the Scientific Research Fund of Hunan Provincial
ten, the cost escalates to 431.26 s. For model update, Education Department of China (No. 22A0056).
the time increases from 76.24 s with two client nodes References
to 102.13 s with ten client nodes. Overall, the
additional computational overhead introduced by the [1] L. Deng and D. Yu, Deep learning: Methods and
BPS-FL to enhance privacy protection in federated applications, Found. Trends® Signal Process., vol. 7, nos.
3&4, pp. 197–387, 2014.
learning is quite reasonable. The increase in [2] L. Peng, N. Wang, N. Dvornek, X. Zhu, and X. Li, FedNI:
computational cost remains within acceptable limits Federated graph learning with network inpainting for
and does not have a significant impact on overall population-based disease prediction, IEEE Trans. Med.
system performance. Imag., vol. 42, no. 7, pp. 2032–2043, 2023.
[3] Z. Li, X. Wang, W. Yang, J. Wu, Z. Zhang, Z. Liu, M.
8 Conclusion Sun, H. Zhang, and S. Liu, A unified understanding of
deep NLP models for text classification, IEEE Trans. Vis.
In this paper, in order to effectively address the privacy Comput. Graph., vol. 28, no. 12, pp. 4980–4994, 2022.
and security threats faced by Federated Learning, we [4] R. Zhao, Y. Wang, Z. Xue, T. Ohtsuki, B. Adebisi, and G.
have proposed BPS-FL scheme. The scheme can Gui, Semisupervised federated-learning-based intrusion
detection method for Internet of Things, IEEE Internet
effectively protect the client’s data privacy while
Things J., vol. 10, no. 10, pp. 8645–8657, 2023.
providing effective protection against model poisoning [5] B. McMahan, E. Moore, D. Ramage, S. Hampson, and
attacks. BPS-FL scheme encrypts the local gradient B.A. y Arcas, Communication-efficient learning of deep
through the threshold homomorphic encryption to networks from decentralized data, in Proc. of 20th Int.
ensure the privacy and security of client data. This Conf. on Artificial Intelligence and Statistics, Ft.
encryption allows gradient aggregation in an encrypted Lauderdale, FL, USA, 2017, pp. 1273–1282.
[6] X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T.
state without disclosing the gradient information of the Baker, VeriFL: communication-efficient and fast
client. To achieve robust aggregation, in BPS-FL, we verifiable aggregation for federated learning, IEEE Trans.
have developed a Byzantine-robust aggregation Inf. Forensics Secur., vol. 16, pp. 1736–1751, 2021.
protocol that minimizes the impacts from malicious [7] H. Zhou, G. Yang, H. Dai, and G. Liu, PFLF: Privacy-
preserving federated learning framework for edge
gradients and ensures a secure aggregation of models at
computing, IEEE Trans. Inf. Forensics Secur., vol. 17, pp.
the ciphertext level. This protocol can effectively 1905–1918, 2022.
aggregate client-side gradients to achieve global model [8] R. Shokri, M. Stronati, C. Song, and V. Shmatikov,
updating while ensuring data privacy. The BPS-FL Membership inference attacks against machine learning
scheme also utilizes a blockchain as the underlying models, in Proc. IEEE Symp. on Security and Privacy, San
Jose, CA, USA, 2017, pp. 3–18.
distributed architecture to further improve the
[9] M. Al-Rubaie and J. M. Chang, Privacy-preserving
reliability of the system, preventing the single-point-of- machine learning: Threats and solutions, IEEE Secur.
failure, and ensuring data immutability as well as Priv., vol. 17, no. 2, pp. 49–58, 2019.
traceability and transparency of the model training [10] X. Cao, J. Jia, and N. Z. Gong, Provably secure federated
process. The performance of the BPS-FL scheme has learning against malicious clients, Proc. AAAI Conf. Artif.
Intell., vol. 35, no. 8, pp. 6885–6893, 2021.
been validated on different datasets through extensive [11] Y. Li, H. Li, G. Xu, T. Xiang, X. Huang, and R. Lu,
analysis and experiments. The results have shown that Toward secure and privacy-preserving distributed deep
our scheme exhibits robustness to poisoning attacks learning in fog-cloud computing, IEEE Internet Things J.,
and maintains high classification accuracy even in the vol. 7, no. 12, pp. 11460–11472, 2020.
[12] J. H. Bell, K. A. Bonawitz, A. Gascón, T. Lepoint, and M.
existence of a large number of malicious participants.
Raykova, Secure single-server aggregation with (poly)
Acknowledgment logarithmic overhead, in Proc. 2020 ACM SIGSAC Conf.
Computer and Communications Security, Virtual Event,
This work was supported by the National Natural Science 2020, pp.1253–1269.
 212 Big Data Mining and Analytics, February 2025, 8(1): 189−213

[13] K. Nandakumar, N. Ratha, S. Pankanti, and S. Halevi, [27] B. Hou, J. Gao, X. Guo, T. Baker, Y. Zhang, Y. Wen, and
Towards deep neural network training on encrypted data, Z. Liu, Mitigating the backdoor attack by federated filters
in Proc. IEEE/CVF Conf. Computer Vision and Pattern for industrial IoT applications, IEEE Trans. Ind. Inform.,
Recognition Workshops, Long Beach, CA, USA, 2019, pp. vol. 18, no. 5, pp. 3562–3571, 2022.
40–48. [28] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V.
[14] L. T. Phong, Y. Aono, T. Hayashi, L. Wang, and S. Shmatikov, How to backdoor federated learning, in Proc.
Moriai, Privacy-preserving deep learning via additively of Twenty Third Int. Conf. on Artificial Intelligence and
homomorphic encryption, IEEE Trans. Inf. Forensics Statistics, Virtual Event, 2020, pp. 2938−2948.
Secur., vol. 13, no. 5, pp. 1333–1345, 2018. [29] E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, The
[15] L. Yu, L. Liu, C. Pu, M. E. Gursoy, and S. Truex, hidden vulnerability of distributed learning in Byzantium,
Differentially private model publishing for deep learning, in Proc. of the 35th Int. Conf. on Machine Learning,
in Proc. IEEE Symp. on Security and Privacy, San Stockholm, Sweden, 2018, pp. 3521−3530.
Francisco, CA, USA, 2019, pp. 332–349. [30] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B.
[16] K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth,
Jin, T. Q. S. Quek, and H. Vincent Poor, Federated Practical secure aggregation for privacy-preserving
learning with differential privacy: Algorithms and machine learning, in Proc. 2017 ACM SIGSAC Conf.
performance analysis, IEEE Trans. Inf. Forensics Secur., Computer and Communications Security, Dallas, TX,
vol. 15, pp. 3454–3469, 2020. USA, 2017 pp. 1175–1191.
[17] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. [31] S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig,
Stainer, Machine learning with adversaries: Byzantine R. Zhang, and Y. Zhou, A hybrid approach to privacy-
tolerant gradient descent, in Proc. 31st Int. Conf. Neural preserving federated learning, in Proc. 12th ACM
Information Processing Systems, Long Beach, CA, USA, Workshop on Artificial Intelligence and Security, London,
2017, pp. 118 – 128. UK, 2019, pp. 1–11.
[18] S. Rajput, H. Wang, Z. Charles, and D. Papailiopoulos, [32] Y. Li, Y. Zhou, A. Jolfaei, D. Yu, G. Xu, and X. Zheng,
DETOX: A redundancy-based framework for faster and Privacy-preserving federated learning framework based on
more robust gradient aggregation, arXiv preprint arXiv: chained secure multiparty computing, IEEE Internet
1907.12205, 2019. Things J., vol. 8, no. 8, pp. 6178–6186, 2021.
[19] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, Byzantine- [33] Y. Miao, R. Xie, X. Li, X. Liu, Z. Ma, and R. H. Deng,
robust distributed learning: Towards optimal statistical Compressed federated learning based on adaptive local
rates, in Proc. 35th Int. Conf. on Machine Learning, differential privacy, in Proc. 38th Annual Computer
Stockholm, Sweden, 2018, pp. 5650– 5659. Security Applications Conference, Austin, TX, USA,
[20] M. Fang, X. Cao, J. Jia, and N. Z. Gong, Local model 2022, pp. 159–170.
poisoning attacks to Byzantine-robust federated learning, [34] G. Xu, H. Li, S. Liu, K. Yang, and X. Lin, VerifyNet:
arXiv preprint arXiv: 1911.11815, 2019. Secure and verifiable federated learning, IEEE Trans. Inf.
[21] X. Cao, M. Fang, J. Liu, and N. Z. Gong, FLTrust: Forensics Secur., vol. 15, pp. 911–926, 2020.
Byzantine-robust federated learning via trust [35] J. So, B. Güler, and A. S. Avestimehr, Byzantine-resilient
bootstrapping, arXiv preprint arXiv: 2012.13995, 2020. secure federated learning, IEEE J. Sel. Areas Commun.,
[22] Y. Dong, X. Chen, K. Li, D. Wang, and S. Zeng, FLOD: vol. 39, no. 7, pp. 2168–2181, 2021.
Oblivious defender for private Byzantine-robust federated [36] X. Liu, H. Li, G. Xu, Z. Chen, X. Huang, and R. Lu,
learning with dishonest-majority, in Proc. 26th European Privacy-enhanced federated learning against poisoning
Symposium on Research in Computer Security, Darmstadt, adversaries, IEEE Trans. Inf. Forensics Secur., vol. 16, pp.
Germany, 2021. pp. 497–518, 4574–4588, 2021.
[23] X. Ma, X. Sun, Y. Wu, Z. Liu, X. Chen, and C. Dong, [37] L. Zhao, J. Jiang, B. Feng, Q. Wang, C. Shen, and Q. Li,
Differentially private Byzantine-robust federated learning, SEAR: Secure and efficient aggregation for Byzantine-
IEEE Trans. Parallel Distrib. Syst., vol. 33, no. 12, pp. robust federated learning, IEEE Trans. Dependable Secure
3690–3701, 2022. Comput., vol. 19, no. 5, pp. 3329–3342, 2022.
[24] A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. [38] Z. Zhang, J. Li, S. Yu, and C. Makaya, SAFELearning:
Beaufays, S. Augenstein, H. Eichner, C. Kiddon, and D. Enable backdoor detectability in federated learning with
Ramage, Federated learning for mobile keyboard secure aggregation, arXiv preprint arXiv: 2102.02402,
prediction, arXiv preprint arXiv: 1811.03604, 2018. 2021.
[25] Z. Wu, Q. Ling, T. Chen, and G. B. Giannakis, Federated [39] Y. Miao, Z. Liu, H. Li, K.-K R. Choo, and R. H. Deng,
variance-reduced stochastic gradient descent with Privacy-preserving Byzantine-robust federated learning
robustness to Byzantine attacks, IEEE Trans. Signal via blockchain systems, IEEE Trans. Inf. Forensics Secur.,
Process., vol. 68, pp. 4583–4596, 2952. vol. 17, pp. 2848–2861, 2022.
[26] X. Gong, Y. Chen, Q. Wang, and W. Kong, Backdoor [40] M. Shayan, C. Fung, C. J. M. Yoon, and I. Beschastnikh,
attacks and defenses in federated learning: State-of-the-art, Biscotti: A blockchain system for private and secure
taxonomy, and future directions, IEEE Wirel. Commun., federated learning, IEEE Trans. Parallel Distrib. Syst.,
vol. 30, no. 2, pp. 114–121, 2023. vol. 32, no. 7, pp. 1513–1525, 2021.
 Jianping Yu et al.: BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning 213

[41] P. Paillier, Public-key cryptosystems based on composite [43] G. Bonnoron, C. Fontaine, G. Gogniat, V. Herbert, V.
degree residuosity classes, in Proc. Int. Conf. on the Lapôtre, V. Migliore, and A. Roux-Langlois,
Theory and Applications of Cryptographic Techniques, Somewhat/fully homomorphic encryption: Implementation
Prague, Czech Republic, 1999, pp. 223–238. progresses and challenges, in Proc. Int. Conf. on Codes,
[42] J. H. Cheon, A. Kim, M. Kim, and Y. Song, Cryptology, and Information Security, doi: 10.1007/978-3-
Homomorphic encryption for arithmetic of approximate 319-55589-8_5.
[44] G. Xu, H. Li, Y. Zhang, S. Xu, J. Ning, and R. H. Deng,
numbers, in Proc. ASIACRYPT 2017: 23rd International
Privacy-preserving federated deep learning with irregular
Conference on the Theory and Applications of Cryptology
users, IEEE Trans. Dependable Secure Comput., vol. 19,
and Information Security, Hong Kong, China, 2017, pp.
no. 2, pp. 1364–1381, 2022.
409–437.

Jianping Yu received the BEng degree in Hang Yao is currently a master student in
computer science and technology and the computer technology at Hunan Normal
PhD degree in computer application University, China, after obtaining the
technology from Hunan University, BEng degree from Dalian Minzu
Changsha, China in 2003 and 2008, University, China in 2022. His research
respectively. He is currently an associate interests include federated learning and
professor at College of Information blockchain technology.
Science and Engineering, Hunan Normal
University, China. He is a senior member of the China
Computer Federation, and a very active reviewer for many Xiaojun Cao received the BEng degree
international journals and conferences including the IEEE from Tsinghua University and the MEng
Communication Magazine, etc. He has authored more than 30 degree from Chinese Academy of
related papers. His research interests include blockchain Sciences, China in 1996 and 1999,
technology, deep learning, IoTs, and artificial intelligence. respectively, and the PhD degree in
computer science and engineering from the
Kai Ouyang is currently a master student State University of New York at Buffalo,
in computer science and technology at USA in 2004. Currently, he is a professor
Hunan Normal University, China, after at Department of Computer Science, Georgia State University,
obtaining the BEng degree from Nanchang USA. He is a distinguished lecturer of the IEEE ComSoc
University, China in 2021. His research (2019—2020) and served as the chair for IEEE ComSoc Optical
interests include federated learning and Networking Technical Committee (ONTC). His research
blockchain technology. interests include modeling, analysis, protocols/algorithms
design, as well as data processing for intelligent networks and
cyber-physical systems.
Lianming Zhang received the BEng and
MEng degrees from Hunan Normal
University, China in 1997 and 2000,
respectively, and the PhD degree from
Central South University, China in 2006.
He is currently a professor and doctoral
supervisor at Hunan Normal University,
China, and a distinguished member of the
China Computer Federation. His research interests include IoT,
intelligent networks, edge computing, and machine learning.