# EIFFeL: Ensuring Integrity for Federated Learning

arXiv: https://arxiv.org/abs/2112.12727 · HTML: https://mlsanity.com/paper/2112.12727/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Dec 2021.

## Built on by (most cited first, 28 of 28)

- [Zero-Knowledge Proof-based Verifiable Decentralized Machine Learning in Communication Network: A Comprehensive Survey](https://mlsanity.com/paper/2310.14848/) (2023)
- [Flamingo: Multi-Round Single-Server Secure Aggregation with Applications to Private Federated Learning](https://mlsanity.com/paper/2308.09883/) (2023)
- [A Survey for Federated Learning Evaluations: Goals and Measures](https://mlsanity.com/paper/2308.11841/) (2023)
- [Machine Learning with Confidential Computing: A Systematization of Knowledge](https://mlsanity.com/paper/2208.10134/) (2022)
- [zPROBE: Zero Peek Robustness Checks for Federated Learning](https://mlsanity.com/paper/2206.12100/) (2022)
- [MUDGUARD: Taming Malicious Majorities in Federated Learning using Privacy-Preserving Byzantine-Robust Clustering](https://mlsanity.com/paper/2208.10161/) (2022)
- [Secure and Verifiable Data Collaboration with Low-Cost Zero-Knowledge Proofs](https://mlsanity.com/paper/2311.15310/) (2023)
- [Can Membership Inferencing be Refuted?](https://mlsanity.com/paper/2303.03648/) (2023)
- [TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2501.05053/) (2025)
- [PrivatEyes: Appearance-based Gaze Estimation Using Federated Secure Multi-Party Computation](https://mlsanity.com/paper/2402.18970/) (2024)
- [Robustness of Locally Differentially Private Graph Analysis Against Poisoning](https://mlsanity.com/paper/2210.14376/) (2022)
- [AnoFel: Supporting Anonymity for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2306.06825/) (2023)
- [Robust and Actively Secure Serverless Collaborative Learning](https://mlsanity.com/paper/2310.16678/) (2023)
- [Asynchronous Byzantine Federated Learning](https://mlsanity.com/paper/2406.01438/) (2024)
- [Perfect Privacy for Discriminator-Based Byzantine-Resilient Federated Learning](https://mlsanity.com/paper/2506.13561/) (2025)
- [How to Securely Shuffle? A survey about Secure Shufflers for privacy-preserving computations](https://mlsanity.com/paper/2507.01487/) (2025)
- [CQSA: Byzantine-robust Clustered Quantum Secure Aggregation in Federated Learning](https://mlsanity.com/paper/2602.22269/) (2026)
- [SABLE: Secure And Byzantine robust LEarning](https://mlsanity.com/paper/2309.05395/) (2023)
- [Fluent: Round-efficient Secure Aggregation for Private Federated Learning](https://mlsanity.com/paper/2403.06143/) (2024)
- [Decoding FL Defenses: Systemization, Pitfalls, and Remedies](https://mlsanity.com/paper/2502.05211/) (2025)
- [SLVR: Securely Leveraging Client Validation for Robust Federated Learning](https://mlsanity.com/paper/2502.08055/) (2025)
- [CADRE: Customizable Assurance of Data Readiness in Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2505.23849/) (2025)
- [ZORRO: Zero-Knowledge Robustness and Privacy for Split Learning (Full Version)](https://mlsanity.com/paper/2509.09787/) (2025)
- [Giskard : Byzantine Robust and Confidential Aggregation for Large-Scale Decentralized Learning](https://mlsanity.com/paper/2606.19129/) (2026)
- [The Power of Backdoor Absorption in Community Training](https://mlsanity.com/paper/2607.06643/) (2026)
- [End-to-End Verifiable and Robust Federated Learning](https://mlsanity.com/paper/2609.15521/) (2026)
- [OPFL: Optimistic Verification of Federated Learning via Empirical Boundary](https://mlsanity.com/paper/2609.37011/) (2026)
- [PoCoFL: POlicy-COmpliant Federated Learning](https://mlsanity.com/paper/2610.03650/) (2026)

## Abstract (arXiv)

Federated learning (FL) enables clients to collaborate with a server to train a machine learning model. To ensure privacy, the server performs secure aggregation of updates from the clients. Unfortunately, this prevents verification of the well-formedness (integrity) of the updates as the updates are masked. Consequently, malformed updates designed to poison the model can be injected without detection. In this paper, we formalize the problem of ensuring textitboth update privacy and integrity in FL and present a new system, textsfEIFFeL, that enables secure aggregation of textitverified updates. textsfEIFFeL is a general framework that can enforce textitarbitrary integrity checks and remove malformed updates from the aggregate, without violating privacy. Our empirical evaluation demonstrates the practicality of textsfEIFFeL. For instance, with 100 clients and 10% poisoning, textsfEIFFeL can train an MNIST classification model to the same accuracy as that of a non-poisoned federated learner in just 2.4s per iteration.