1
Scalable and Verifiable Federated Learning for Cross-Institution Financial Fraud Detection
arXiv:2604.23437v1 [cs.CR] 25 Apr 2026
Prajwal Panth, Student Member, IEEE, and Nishant Nigam
Abstract—The global financial ecosystem confronts a critical operational asymmetry: while fraud syndicates operate as borderless, distributed networks, banking institutions remain trapped in regulatory data silos, largely blind to crossinstitutional threat patterns due to strict privacy laws such as GDPR. Although Federated Learning (FL) offers a collaborative bridge, standard protocols impose a three-way tension among scalability, privacy, and integrity. Homomorphic encryption schemes are computationally prohibitive, while standard pairwise masking protocols require O(N 2 ) key exchanges in their basic form. Moreover, these approaches do not provide verifiable mechanisms to detect adversarial or malformed updates. Existing defenses also remain vulnerable to Gradient Inversion attacks, enabling adversaries to reconstruct sensitive transaction data. To address these limitations, we propose Dynamic Sharded Federated Learning (DSFL), a verifiable secure aggregation framework for cross-institution financial fraud detection. DSFL replaces bandwidth-intensive mesh topologies with Dynamic Stochastic Sharding, reducing communication complexity from O(N 2 ) to O(N · m), where m is a fixed cluster size constant, achieving asymptotically linear scalability. To mitigate insider threats, we introduce Linear Integrity Tags, an additivehomomorphic commitment mechanism that provides probabilistic consistency verification of submitted updates without the overhead of zero-knowledge proofs, while not enforcing semantic correctness of gradients. Additionally, the Active Neighborhood Recovery protocol ensures robust aggregation under participant dropouts. Empirical evaluation on the Credit Card Fraud Detection Dataset (ULB) demonstrates an approximately 33× latency reduction compared to Paillier-based secure aggregation, while maintaining high resilience under simulated failure conditions. These results position DSFL as a practical foundation for scalable and privacy-preserving collaborative fraud detection. Index Terms—Federated Learning, Secure Aggregation, Privacy-Preserving Machine Learning, Financial Fraud Detection, Model Poisoning, Gradient Inversion Attacks, Communication Efficiency
I. I NTRODUCTION
T
HE contemporary financial landscape is increasingly defined by a critical asymmetry between threat actors and defensive institutions. While financial crime is inherently global and networked, financial defense mechanisms remain fundamentally local and siloed. Money laundering syndicates frequently utilize “smurfing” and “layering” techniques—splitting large illicit transfers into thousands of micro-transactions spread across dozens of heterogeneous institutions—to deliberately evade the static threshold-based Prajwal Panth is with the School of Computer Engineering, KIIT Deemed to be University, Bhubaneswar, India. He is the corresponding author (e-mail: [email protected]). Nishant Nigam is with the School of Electronics Engineering, KIIT Deemed to be University, Bhubaneswar, India (e-mail: [email protected]).
detection systems (e.g., AML rules) of any single bank. To effectively interdict such distributed threats, financial institutions must aggregate their transaction intelligence to form a cohesive, network-wide perspective. However, the legal frameworks governing data privacy, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), strictly prohibit the sharing of Personally Identifiable Information (PII) across institutional boundaries without explicit consent. A. Scenario: The Data Sovereignty Deadlock To illustrate the operational necessity of our proposed framework, consider a simplified ecosystem involving two distinct financial entities: Bank A (Retail Segment): This institution holds data predominantly on local debit card transactions. It observes fraud manifesting as “high-frequency, low-value purchases” at gas stations and convenience stores. • Bank B (Corporate/High-Net-Worth): Serving a different demographic, Bank B observes fraud manifesting as “single large-value luxury goods purchases” via international e-commerce portals. •
If Bank A trains a fraud detection model solely on its private data, the resulting intelligence remains fundamentally blind to the luxury-goods attack vector. Conversely, Bank B’s model will fail to detect high-frequency skimming patterns. Ideally, a unified global model should learn the mathematical gradients of both fraud patterns simultaneously to minimize False Negatives. However, sharing raw transaction logs between Bank A and Bank B violates data localization laws. Furthermore, if they employ standard FL, a curious aggregator or a compromised node can mathematically invert the shared gradients to reconstruct exact transaction amounts, merchant IDs, and customer locations [1], [2]. This creates a regulatory deadlock: collaboration is necessary for security, but traditional data sharing is illegal, and standard FL is insecure. B. The Scalability–Privacy–Integrity Trilemma Current solutions to the data sovereignty deadlock fail to simultaneously satisfy three critical requirements in enterprise deployments, which we term the Scalability–Privacy– Integrity Trilemma: 1) Scalability: The protocol’s communication and computation overhead must grow at most linearly with the number of participants N .
2
2) Privacy: Individual gradient vectors must remain computationally hidden under standard cryptographic assumptions from the aggregator and any coalition of participants below a threshold size. 3) Integrity: The aggregator must be able to verify that submitted updates satisfy consistency constraints, detecting malformed or tampered inputs. This mechanism can identify certain classes of invalid updates, though it does not prevent all forms of model poisoning. No existing standard protocol satisfies all three simultaneously. Asymmetric Homomorphic Encryption (HE) schemes like Paillier [3] provide Privacy and Integrity but fail on Scalability: each encryption requires modular exponentiation over 2048bit composites, yielding an aggregation cost of O(N · d) per round (where d is the model dimension) with extremely large constants [3]. Conversely, mask-based Multi-Party Computation (MPC) protocols like Google’s Secure Aggregation (SecAgg) [4] provide Privacy but fail on both Scalability and Integrity: they require O(N 2 ) pairwise key exchanges, and they offer no defense against Model Poisoning [5], where a malicious participant injects invalid gradients to degrade the global model’s convergence. In this paper, we propose DSFL, a practically deployable framework designed to resolve all three limitations simultaneously. We introduce a novel clustered architecture utilizing lightweight symmetric cryptography and additivehomomorphic integrity checks to achieve secure, scalable, and verifiable aggregation. II. S YSTEM M ODEL AND T HREAT D EFINITIONS A. Notation Table I summarizes all symbols used throughout this paper. We denote scalars by lowercase italic letters (e.g., s), vectors by bold lowercase letters (e.g., x), sets by calligraphic uppercase letters (e.g., U), and the sign function by sgn(u, v) = +1 if u < v, else −1. All arithmetic, unless stated otherwise, is performed in the finite field Fp where p is a large prime satisfying p > N · m · maxu Q(gu ) ∞ (the overflow-prevention condition, made explicit in Claim 2). B. Network Model and Financial Constraints We model a synchronous federated system consisting of N participants U = {P1 , . . . , PN } and a central aggregation server Sagg . The system operates on a finite field Fp defined by a Mersenne prime p = 261 −1 or a similar 64-bit prime. In a real-world financial context, network conditions are non-ideal. Participants may possess varying computational capabilities, and secure communication channels (TLS 1.3) are assumed for all data transfers. Unlike previous works that assume a star topology with full-mesh trust, we model the trust network as a Dynamic Sparse Graph, where cryptographic relationships are ephemeral and restricted to subsets of peers defined by a deterministic clustering algorithm. The system is subject to two critical financial constraints: 1) High-Frequency Updates: Fraud patterns shift rapidly. The protocol must complete a global aggregation round within seconds to reflect the latest threat vectors.
TABLE I N OTATION R EFERENCE TABLE Symbol
Definition
N m Ns U Sagg Ci D A t gu vu xu suv mu α τu p, M λ d Q(·) ∆ PRF(·) sgn(u, v)
Total number of participants Fixed cluster (shard) size; system constant (e.g., m = 20) Number of shards; Ns = ⌈N/m⌉ Set of all participants {P1 , . . . , PN } Central aggregation server The i-th shard; |Ci | = m Set of dropped-out participants in a round Adversary Round index Raw gradient of participant u Quantized gradient: vu = Q(gu ) Masked (submitted) update of participant u Shared ECDH secret between participants u and v Zero-sum mask of participant u Random challenge vector; α ∈ ZdM Linear Integrity Tag of participant u Large 64-bit primes used as field moduli Security parameter; λ = 64 for a 64-bit prime Model dimension (number of gradient components) Stochastic quantization operator Quantization scaling factor (global constant per round) Pseudo-Random Function (instantiated as AES-CTR) Sign function: +1 if u < v, else −1
2) Zero-Data Retention: The server Sagg must operate as a stateless switch, retaining no derived knowledge of input vectors post-aggregation.
C. Threat Model: Malicious & Unreliable We upgrade the standard threat model to reflect the hostile realities of modern financial infrastructure. We assume the adversary A may control Sagg and a subset of participants C ⊂ U , subject to an honest-majority constraint within each shard (fewer than m − 1 of the m members of any shard are adversarial; see Section VI-B for the formal bound): 1) Semi-Honest Aggregator: Sagg follows the protocol specification but passively logs all messages, timestamps, and metadata to attempt Gradient Inversion Attacks, seeking to reconstruct private training data Di . 2) Malicious Clients (Active Poisoning): An adversarial bank may submit invalid gradients xmal —such as random noise, bit-flipped vectors, or targeted backdoors— to destroy the global model’s utility without detection under the protocol’s consistency constraints. 3) Unreliable Network (Dropouts): Up to 30% of banks may drop offline mid-round due to connectivity failures. The protocol must guarantee that aggregation completes without restarting the round, utilizing surviving peers to reconstruct the missing security contexts.
III. F RAMEWORK DSFL re-engineers the Secure Aggregation pipeline into a rigorous three-phase algebraic system: Topology Setup via Sharding, Verifiable Masked Execution, and Active Neighborhood Recovery.
3
pairwise secret exchange (via Elliptic Curve Diffie-Hellman, ECDH) occurs only between nodes within the same shard Ci . This reduces per-user key storage and computation from O(N ) to O(m), resulting in a total system communication complexity of O(N · m), which is asymptotically linear in N since m is a fixed constant. B. Phase II: Intra-Shard Masking & Verifiability Within each shard Ci , banks perform Pairwise Zero-Sum Masking to obfuscate their gradients and submit Linear Integrity Tags to enable detection of malformed or inconsistent updates. 1) Challenge Generation: The server publishes a cryptographic commitment to a random seed ρ. Once clients acknowledge receipt of the commitment, the server reveals ρ, from which a random challenge vector α ∈ ZdM is derived. The commit-before-reveal ordering ensures that clients cannot generate a malicious update vector tailored to α. 2) Masked Input Generation: Each participant u first quantizes its raw gradient: vu = Q(gu ) ∈ Zd . It then derives a zero-sum masking vector from the shared ECDH secrets suv established with its shard neighbors, using AES-CTR as the PRF to expand each scalar secret into a d-dimensional mask. The masked update submitted to the server is: X X xu = vu + PRF(suv ) − PRF(suv ) (mod M ) (2) v∈Ci u<v
v∈Ci u>v
where M is a large 64-bit prime defining the working field ZM . 3) Linear Integrity Tag: Simultaneously, each participant computes a Linear Integrity Tag τu as the inner product of its masked update with the challenge vector: τu = ⟨xu , α⟩
Fig. 1. Protocol Execution Workflow. A decision-logic view of the aggregation round. The “Active Recovery” branch triggers only upon detecting network instability.
?
The fundamental bottleneck of traditional Secure Aggregation is the requirement for every user to establish a shared secret with every other user (N (N − 1)/2 keys). To achieve linear scalability, we introduce Dynamic Stochastic Sharding. At the start of round t, the server and clients use a shared cryptographic pseudo-random function (PRF) seeded with the round identifier to partition U into Ns = ⌈N/m⌉ disjoint shards C1 , . . . , CNs , each of fixed size m ≪ N (e.g., m = 20): Shard(Pu ) = PRF IDu ∥ Roundt (mod Ns ) (1) By making the shard assignment dependent on the round nonce, we prevent Sybil attacks where malicious nodes attempt to pre-calculate groupings to dominate a shard. Crucially,
(3)
This tag is additive-homomorphic: for any two inputs xu and xv , τu + τv = ⟨xu + xv , α⟩ (mod M ). Consequently, the server can verify the integrity of the aggregate P without accessing individual updates. It computes X = agg u xu and P Tagg = u τu , then verifies: ⟨Xagg , α⟩ = Tagg
A. Phase I: Dynamic Stochastic Sharding
(mod M )
(mod M )
(4)
A mismatch indicates active tampering. Because the adversary must commit to xmal before learning α, forging a valid tag requires solving a random linear equation over ZM , which succeeds with probability at most 1/M under the assumption that the challenge vector is uniformly sampled and independent of the adversary’s input. (see Theorem V-A). C. Phase III: Active Neighborhood Recovery A critical failure mode is the Dropout Problem: if participant u adds mask PRF(suv ) but partner v disconnects before subtracting it, the zero-sum property is broken and the aggregate becomes indistinguishable from noise. DSFL introduces an Active Neighborhood Recovery protocol: 1) Fault Detection: Sagg monitors heartbeats and identifies the dropout set D upon timeout.
4
2) Secret Retrieval: For every dropped user d ∈ D, the server requests only the pairwise seeds spd (shared between d and its surviving shard neighbors p ∈ Ci \ D). This design avoids revealing seeds spp′ shared between two surviving participants, thereby limiting privacy exposure, although partial mask reconstruction may leak limited structural information under repeated observations. Conceptually, this mechanism parallels threshold reconstruction in Shamir’s Secret Sharing [6], though restricted to pairwise exchanges rather than global polynomial interpolation. 3) Neutralization: Surviving peers authenticate and securely transmit EncS (spd ). The server regenerates the orphaned masks using these seeds. 4) Correction: The orphaned masks are canceled from the raw aggregate: X X Xsaf e = Xraw + sgn(p, d)·PRF(spd ) (5)
B. Proof of Gradient Preservation (Correctness) Claim 2 (AggregateP Correctness): The server-side aggregate satisfies Xagg ≡ u Q(gu ) (mod p), and the modular sum equals the integer sum provided p > N · m · ∆, where ∆ is the quantization range bound and each ∥Q(gu )∥∞ ≤ ∆. Proof. The masked update submitted by participant u is (from (2)): X xu = Q(gu ) + sgn(u, v) · PRF(suv ) (mod p) (10) v∈Ci (u)
P The server computes Xagg = u∈U xu (mod p). Expanding and separating the mask term: X X X Xagg = Q(gu ) + sgn(u, v) PRF(suv ) (mod p) u
u v∈Ci (u)
|
d∈D p∈Ci \D
IV. M ATHEMATICAL F ORMALISM All symbols follow Table I. All arithmetic is in Fp unless noted. A. Proof of Linear Scalability via Induced Subgraphs Claim 1 (Complexity Reduction): The communication complexity of DSFL scales as O(N · m), which is O(N ) since m is a fixed system constant, contrasting with the quadratic O(N 2 ) complexity of standard Secure Aggregation. Proof. In standard Secure Aggregation [4], the trust graph is the complete graph KN . The number of pairwise key exchanges is: N N (N − 1) =⇒ O(N 2 ) (6) |Estd | = = 2 2 In DSFL, we define a mapping Φ : V → {1, . . . , Ns } that partitions vertices into Ns = ⌈N/m⌉ disjoint shards {C1 , . . . , CNs } each of size m. Pairwise edges exist only between u, v with Φ(u) = Φ(v). The induced topology is a union of Ns disjoint cliques of size m. The total edge count is: Ns X |Ci | N m(m − 1) |EDSF L | = = · (7) m 2 2 i=1 N (m − 1) 2
(8)
where the m factors cancel between N/m and m(m − 1)/2 in step (8). Since m is a fixed system constant independent of N: |EDSF L | = Q.E.D.
(m − 1) · N =⇒ O(N · m) = O(N ) 2
} (11)
This mechanism allows the protocol to recover even if up to 30% of nodes fail simultaneously.
=
{z
∆mask
(9)
For every edge (u, v) ∈ EDSF L , the shared secret suv = svu contributes +PRF(suv ) from u’s side (since u < v) and −PRF(svu ) from v’s side (since v > u): X ∆mask = PRF(suv ) − PRF(suv ) = 0 (12) {u,v}∈EDSF L
P Thus Xagg = u Q(gu ) (mod p). The P overflow-prevention condition p > N · m · ∆ ensures that u Q(gu ) < p, so the modular reduction is the identity and Xagg equals the true integer sum. For the credit card fraud detection dataset with N = 10, m = 20, and ∆ = 216 (16-bit quantization), the required bound is N · m · ∆ = 10 · 20 · 65536 ≈ 1.3 × 107 , which is satisfied by p = 261 − 1. Q.E.D.
C. Unbiasedness of Stochastic Quantization Lemma 1: The stochastic quantization Q(·) with a globally coordinated scaling factor ∆ introduces zero bias: E[Q(gu · ∆)/∆] = gu . Proof. ∆ is a global constant broadcast by Sagg at the start of each round, ensuring all participants use the same scaling. Let y ∈ R be any scalar component of gradient gu . Define z = y · ∆ and write z = ⌊z⌋ + ε with ε ∈ [0, 1). The quantization rule is: ( ⌊z⌋ + 1 with probability ε Q(z) = (13) ⌊z⌋ with probability 1 − ε The expected value is: E[Q(z)] = (⌊z⌋ + 1)ε + ⌊z⌋(1 − ε) = ⌊z⌋ + ε = z
(14)
Thus the de-scaled estimate ŷ = Q(z)/∆ satisfies E[ŷ] = z/∆ = y. Applying componentwise: E[Q(gu · ∆)/∆] = gu .
5
Fig. 2. DSFL System Architecture. The framework separates trusted Banking Nodes (Tier 1) from the untrusted Aggregation Middleware (Tier 2) via a strict network boundary. Client-side sharding (Ci ) ensures linear scalability, while server-side Active Recovery handles node failures without accessing private survivor data.
V. S ECURITY P ROOFS A. Soundness of Consistency-Based Integrity Verification Theorem V-A (Collision Resistance): Let security parameter λ = 64 and field modulus M = p ≈ 2λ . The probability of an adversary A injecting a malformed or inconsistent perturbation vector δ ̸= 0 without detection is at most negl(λ) = 1/p ≈ 5.4 × 10−20 . Proof. The verification equation (4) requires: ⟨X + δ, α⟩ = ⟨X, α⟩ ⟨δ, α⟩ = 0
(mod p)
(mod p)
(15)
Equation (15) defines a hyperplane Hδ in the vector space Fdp orthogonal to δ. By the protocol, the adversary must commit to xmal = xhonest + δ before α is revealed; hence α is drawn uniformly from Fdp independently of δ. The probability of collision is: Pr[A succeeds] =
|Hδ | pd−1 1 = d = = negl(λ) d |Fp | p p
(16)
For λ = 64, Pr ≈ 5.42 × 10−20 , which is negligible in the security parameter λ. Q.E.D.
and up to m − 2 members of any shard, the view of Sagg in a single round is computationally indistinguishable from random under standard cryptographic assumptions in Fdp . Proof Sketch. Consider a target surviving participant u∗ in shard Ci . The server’s view in round t consists of: View S = x1 , . . . , xN , {spd : d ∈ D, p ∈ Ci \ D} (17) ∗ ∗ ∗ ∗ ∗ For P u , we ∗ have xu = vu + mu where mu = ∗ ∗ sgn(u , v) PRF(s ). The secrets s for v ∈ C u v u v i \D v∈Ci (surviving neighbors of u∗ ) are never transmitted to the server in any phase. Only secrets spd with d ∈ D (dropout-associated seeds) are revealed for mask reconstruction. Since u∗ ∈ / D, the secret su∗ v for any surviving v is not disclosed. Under the DDH assumption, the ECDH output su∗ v is computationally indistinguishable from a uniform random element in Fp . Consequently, mu∗ behaves analogously to a one-time pad under computational assumptions, and H(vu∗ | xu∗ ) ≈c H(vu∗ ) per Shannon’s theorem [7]. Fresh ECDH key exchange per round t ensures no key reuse across rounds. Q.E.D.
VI. S ECURITY A NALYSIS A. Resistance to Active Poisoning
B. Forward Secrecy against Gradient Inversion Theorem 2 (Single-Round Gradient Privacy): Under the Decisional Diffie-Hellman (DDH) assumption, for any probabilistic polynomial-time adversary A controlling Sagg
We analyze the resistance against a malicious participant attempting to inject a poison vector δ. To evade detection, the adversary must find δ such that ⟨δ, α⟩ = 0 (mod M ). Since α is drawn uniformly at random from ZdM after the
6
adversary commits to their update (guaranteed by the hash commitment in Phase II), the adversary must guess α blindly. By Theorem V-A, this succeeds with probability negl(λ) = 1/M ≈ 5.4 × 10−20 for M ≈ 264 .
empirical baseline using the complexity functions established in Claim 1; Fig. 6 plots these curves alongside the empirical data point. B. Computational Efficiency & Scalability
B. Collusion Resistance Claim 3 (Collusion Threshold): In a shard of size m, a coalition of c < m − 1 colluding members cannot reconstruct the gradient vu∗ of any honest target u∗ ; a coalition of exactly m − 1 members can. Argument: The masked update xu∗ contains one independent mask term PRF(su∗ v ) for each shard neighbor v. To cancel all mask terms and isolate vu∗ , the coalition needs all m − 1 shared secrets {su∗ v }v̸=u∗ . Each secret is known only to the pair (u∗ , v); a coalition lacking v cannot compute su∗ v without solving ECDH (reduced to DDH). Thus m − 2 colluders lack at least one secret and cannot recover vu∗ , while m − 1 colluders possess all secrets. With our recommended m = 20, an adversary would need to compromise 19 specific peers simultaneously, which is probabilistically negligible given random shard reassignment each round.
We benchmarked client-side encryption and server-side aggregation latency against two baselines: Paillier Homomorphic Encryption (2048-bit keys) and Google’s SecAgg [4]. Paillier was evaluated for N = 10 and its O(N · d) per-round cost extrapolated; SecAgg was evaluated for N = 10 and its O(N 2 ) pairwise cost extrapolated. TABLE II P ROTOCOL S CALABILITY & L ATENCY A NALYSIS (N = 1000, EXTRAPOLATED ) Protocol
Complexity
Latency (s)
BW / User
Paillier HE [3] Google SecAgg [4] DSFL (Ours)
O(N · d) O(N 2 ) O(N · m)
420.5 85.2 12.4
High (modexp) High (mesh keys) Low (shard keys)
Table II illustrates the advantage of stochastic sharding. Paillier HE is CPU-bound with a large per-dimension constant (O(N · d) modular exponentiations per round), while SecAgg becomes bandwidth-bound due to O(N 2 ) key exchanges. DSFL retains the lightweight CPU footprint of symmetric masking while enforcing O(N · m) = O(N ) communication complexity. The latency reduction versus Paillier HE at N = 1000 is 420.5/12.4 ≈ 33.9×. C. Audit: Financial Utility and Robustness The final aggregated global model was evaluated on a heldout test set comprising 20% of transactions unseen during training. This emulates a regulatory audit of the fraud detection system. All reported metrics are mean values over five independent trials; standard deviations are reported in parentheses.
Fig. 3. Security Audit: Malformed Update Detection. Impact of a malicious gradient injection at Round 10. The unprotected model (Red) is permanently degraded. DSFL (Green) detects inconsistencies in malformed updates, rejects invalid payloads, and resumes learning.
VII. P ERFORMANCE E VALUATION A. Experimental Setup We implemented the full DSFL protocol in Python 3.9 using a NumPy backend optimized for vectorized finite-field arithmetic. The simulation environment consisted of a Google Colab environment orchestrating 10 simulated banking nodes. The dataset was the Credit Card Fraud Detection Dataset (ULB), comprising 284,807 transactions [8]. To mimic realworld non-IID data distribution, the dataset was stratified such that each bank received a skewed distribution of fraud classes. All latency figures for N > 10 are analytically extrapolated under idealized scaling assumptions, which may not fully capture real-world system overheads, from the N = 10
Fig. 4. Resilience Analysis. Model utility (AUPRC) under a hostile 20% dropout regime. Standard SecAgg fails to converge (Red) due to uncancelled masks. DSFL (Green) utilizes Active Recovery to restore the gradient sum, tracking the ideal baseline perfectly.
7
Fig. 5. Client-Side Latency Breakdown. The computational budget is dominated by lightweight PRF mask generation. The total per-round overhead is < 100 ms, negligible for high-frequency auditing.
Fig. 6. Scalability Validation. End-to-end latency vs. network size N (empirical at N = 10; extrapolated for N > 10). Paillier HE (Red) and Google SecAgg (Blue) exhibit polynomial growth; DSFL (Green) maintains linear scaling.
TABLE III C OMPARATIVE A NALYSIS : C OMPLEXITY & F EATURES Feature
Paillier HE [3]
Google SecAgg [4]
Complexity
O(N · d)
O(N 2 )
O(N · m)
Dropouts
Robust
Heavy recovery
Immediate (intra-shard)
Poisoning
No defense
No defense
Consistency Check
Topology Comm. Cost
DSFL (Ours)
Star
Full mesh
Sharded
High (2048-bit)
High (key vol.)
Low (1:1 shard)
Global Recall: 91.2% (±0.8%). The collaborative model significantly outperformed the local-model average of 68% (±3.1%), demonstrating successful cross-shard knowledge transfer. • Simulated Financial Impact: In simulation on the Kaggle dataset, the global DSFL model correctly flagged transactions totalling $120,450 that the local-only baseline would have approved. This figure is derived from the held-out test partition and should be interpreted as a relative performance indicator, not a real-world financial forecast. • Resilience to Failure: Under a hostile 20% dropout regime, the Active Recovery mechanism reconstructed all orphaned masks in under 0.8 s. Final model utility (AUPRC) was statistically indistinguishable from the zero-dropout baseline (p > 0.05, paired t-test), confirming robustness without utility loss.
•
Fig. 7. The Data Sovereignty Deadlock. Recall of isolated local models (Blue) vs. the global DSFL model (Green) across ten banking partitions of the Kaggle dataset. Local models exhibit high variance and poor detection of rare fraud patterns; the global model stabilizes performance across the consortium.
VIII. C ONCLUSION AND F UTURE W ORK DSFL advances Secure Aggregation toward a practical, audit-oriented financial infrastructure for cross-institution fraud detection. By replacing the non-scalable full-mesh topology of standard Federated Learning with Dynamic Stochastic Sharding and introducing Linear Integrity Tags—an additive-homomorphic commitment mechanism—we address the Scalability–Privacy–Integrity trade-offs in a unified framework. Our theoretical analysis establishes O(N ) communication complexity (Claim 1), computational gradient privacy under the Decisional Diffie-Hellman (DDH) assumption (Theorem 2), and a negligible probability of undetected malformed update injection (Theorem V-A). We emphasize that the integrity mechanism enforces consistency constraints on submitted updates but does not guarantee semantic correctness
8
of gradients. Empirical evaluation on the Credit Card Fraud Detection Dataset (ULB) demonstrates 91.2% global recall (compared to a 68% local-model average), high robustness under a 20% node failure regime, and an approximate 34× latency reduction over Paillier-based secure aggregation. Future work will focus on two directions: (1) integrating hardware-based Trusted Execution Environments (TEEs), such as Intel SGX, to further secure the key-exchange phase against compromised system environments, and (2) extending the framework to asynchronous secure aggregation settings to eliminate straggler-induced delays and further improve scalability in real-world deployments. R EFERENCES [1] L. Zhu, Z. Liu, and S. Han, Deep leakage from gradients. Red Hook, NY, USA: Curran Associates Inc., 2019. [2] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” in Proceedings of the 34th International Conference on Neural Information Processing Systems, ser. NIPS ’20. Red Hook, NY, USA: Curran Associates Inc., 2020. [3] P. Paillier, “Public-key cryptosystems based on composite degree residuosity classes,” in Advances in Cryptology — EUROCRYPT ’99, J. Stern, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 1999, pp. 223–238. [4] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’17. New York, NY, USA: Association for Computing Machinery, 2017, p. 1175–1191. [Online]. Available: https://doi.org/10.1145/3133956.3133982 [5] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, vol. 108. PMLR, 2020, pp. 2938–2948. [Online]. Available: https: //proceedings.mlr.press/v108/bagdasaryan20a.html [6] A. Shamir, “How to share a secret,” Commun. ACM, vol. 22, no. 11, p. 612–613, Nov. 1979. [Online]. Available: https://doi.org/10.1145/ 359168.359176 [7] C. E. Shannon, “Communication theory of secrecy systems,” The Bell System Technical Journal, vol. 28, no. 4, pp. 656–715, 1949. [8] Machine Learning Group - ULB, Y.-A. L. Borgne, A. D. Pozzolo, O. Caelen, and G. Bontempi, “Credit card fraud detection dataset,” https://www.kaggle.com/datasets/mlg-ulb/creditcardfraud, 2018, transactions made by European cardholders in September 2013; 284,807 transactions with 492 fraud cases.