# POSEIDON: Privacy-Preserving Federated Neural Network Learning

arXiv: https://arxiv.org/abs/2009.00349 · HTML: https://mlsanity.com/paper/2009.00349/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Sep 2020.

## Built on by (most cited first, 24 of 24)

- [A Survey on Vertical Federated Learning: From a Layered Perspective](https://mlsanity.com/paper/2304.01829/) (2023)
- [Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errors](https://mlsanity.com/paper/2112.06872/) (2021)
- [Secure Neuroimaging Analysis using Federated Learning with Homomorphic Encryption](https://mlsanity.com/paper/2108.03437/) (2021)
- [A Survey for Federated Learning Evaluations: Goals and Measures](https://mlsanity.com/paper/2308.11841/) (2023)
- [Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges](https://mlsanity.com/paper/2407.06754/) (2024)
- [Privacy-preserving Decentralized Federated Learning over Time-varying Communication Graph](https://mlsanity.com/paper/2210.00325/) (2022)
- [ScionFL: Efficient and Robust Secure Quantized Aggregation](https://mlsanity.com/paper/2210.07376/) (2022)
- [GuardML: Efficient Privacy-Preserving Machine Learning Services Through Hybrid Homomorphic Encryption](https://mlsanity.com/paper/2401.14840/) (2024)
- [Privacy-Preserving Federated Unlearning with Certified Client Removal](https://mlsanity.com/paper/2404.09724/) (2024)
- [SCOTCH: An Efficient Secure Computation Framework for Secure Aggregation](https://mlsanity.com/paper/2201.07730/) (2022)
- [FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks](https://mlsanity.com/paper/2310.02113/) (2023)
- [WW-FL: Secure and Private Large-Scale Federated Learning](https://mlsanity.com/paper/2302.09904/) (2023)
- [Wildest Dreams: Reproducible Research in Privacy-preserving Neural Network Training](https://mlsanity.com/paper/2403.03592/) (2024)
- [Floe: Federated Specialization for Real-Time LLM-SLM Inference](https://mlsanity.com/paper/2602.14302/) (2026)
- [Privacy-Preserving 3-Layer Neural Network Training](https://mlsanity.com/paper/2308.09531/) (2023)
- [Pencil: Private and Extensible Collaborative Learning without the Non-Colluding Assumption](https://mlsanity.com/paper/2403.11166/) (2024)
- [Split Happens: Combating Advanced Threats with Split Learning and Function Secret Sharing](https://mlsanity.com/paper/2507.10494/) (2025)
- [Protecting Data from all Parties: Combining FHE and DP in Federated Learning](https://mlsanity.com/paper/2205.04330/) (2022)
- [Orchestrating Collaborative Cybersecurity: A Secure Framework for Distributed Privacy-Preserving Threat Intelligence Sharing](https://mlsanity.com/paper/2209.02676/) (2022)
- [Protecting Confidentiality, Privacy and Integrity in Collaborative Learning](https://mlsanity.com/paper/2412.08534/) (2024)
- [Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Users](https://mlsanity.com/paper/2502.08989/) (2025)
- [PRISM: Privacy-preserving Inference System with Homomorphic Encryption and Modular Activation](https://mlsanity.com/paper/2511.07807/) (2025)
- [Choose Wisely and Privately: Proactive Client Selection for Fair and Efficient Federated Learning](https://mlsanity.com/paper/2605.20975/) (2026)
- [Pushing Forward Multi-Secret-Key Homomorphic Encryption for Private Average Aggregation](https://mlsanity.com/paper/2609.01945/) (2026)

## Abstract (arXiv)

In this paper, we address the problem of privacy-preserving training and evaluation of neural networks in an N-party, federated learning setting. We propose a novel system, POSEIDON, the first of its kind in the regime of privacy-preserving neural network training. It employs multiparty lattice-based cryptography to preserve the confidentiality of the training data, the model, and the evaluation data, under a passive-adversary model and collusions between up to N-1 parties. To efficiently execute the secure backpropagation algorithm for training neural networks, we provide a generic packing approach that enables Single Instruction, Multiple Data (SIMD) operations on encrypted data. We also introduce arbitrary linear transformations within the cryptographic bootstrapping operation, optimizing the costly cryptographic computations over the parties, and we define a constrained optimization problem for choosing the cryptographic parameters. Our experimental results show that POSEIDON achieves accuracy similar to centralized or decentralized non-private approaches and that its computation and communication overhead scales linearly with the number of parties. POSEIDON trains a 3-layer neural network on the MNIST dataset with 784 features and 60K samples distributed among 10 parties in less than 2 hours.