Secure Decentralized Federated Learning via Gossip and Virtual Voting
arXiv:2607.08651v1 [cs.LG] 9 Jul 2026
Amirhossein Taherpour
, and Xiaodong Wang
Abstract— Decentralized federated learning (DFL) removes the central server by letting nodes exchange model updates through peer-to-peer gossip, but existing gossip-based methods often lack provenance finality and resilience to Byzantine or lazy participants. Ledger-assisted federated learning (FL) improves auditability, yet blockchains, shards, or settlement committees can reintroduce global coordination costs that conflict with DFL locality. This paper proposes gspDAGFL, a secure DFL framework that derives consensus from the same gossip history used to disseminate models. Nodes exchange model payloads only with neighbors, while full nodes collect event certificates and receiver-endorsed accepted gossip proofs, reconstruct a compact Topology directed acyclic graph (DAG), and run Hashgraph-style virtual voting followed by compact full-node certificates. Finality is over unique modelorigin tuples, not identical local parameter states. To improve resilience, gspDAG-FL combines payload validation, acceptedproof validation, and private semantic audit before aggregation. We formalize the adversarial setting, prove safety and conditional liveness of the control plane, and give a convergence guarantee for certified perturbed gossip under time-varying effective mixing. Experiments on MNIST classification and Penn Treebank language modeling, using fair held-out validation/audit data and networks up to N = 100, show that gspDAG-FL achieves learning quality close to validation-based ledger FL while reducing coordination bottlenecks, improving throughput, and maintaining high invalid-origin detection under mixed Byzantine and lazy participation. Index Terms—Decentralized federated learning (DFL), gossip, Hashgraph, directed acyclic graph (DAG), Byzantine fault tolerance (BFT), virtual voting, federated learning security, auditability.
I. Introduction Federated learning (FL) trains a model across distributed devices or institutions while keeping raw data local and exchanging only model-side information [1]– [3]. In the standard architecture, a central server coordinates local training, aggregation, and model redistribution, often through federated averaging and secure aggregation [4]. This architecture is effective, but it concentrates coordination, trust, and failure modes at the server. It may also amplify privacy risk, since gradients and model updates can leak sensitive information even when raw data are never shared [5]. A natural alternative is decentralized federated learning (DFL), where peers exchange updates directly through a communication graph. Randomized gossip and decentralized stochastic optimization show that repeated neighbor Amirhossein Taherpour and Xiaodong Wang are with the Department of Electrical Engineering, Columbia University, New York, NY, USA (e-mails: [email protected], [email protected]).
, Fellow, IEEE
averaging can converge at a rate controlled by topology and mixing quality [6], [7]. Asynchronous push–pull, pushsum, and compressed gossip variants improve wall-clock efficiency or communication cost under heterogeneous links [8]–[10]. Recent systems such as GossipFL, FedDual, and semi-decentralized optimization further show that neighbor-to-neighbor communication can reduce central bottlenecks [11]–[14]. However, most serverless gossipbased methods assume benign participation. They usually do not provide a system-wide record of update provenance, nor do they define which model origins are final and eligible for aggregation when some nodes are Byzantine, lazy, or behaviorally malicious. Robust aggregation addresses part of this problem by limiting the effect of abnormal updates during aggregation. Byzantine-resilient rules and coordinate-wise robust methods improve resilience under bounded adversarial fractions [15]–[17]. Sybil-aware defenses reduce the impact of multiple colluding identities [18]. Backdoor attacks show, however, that malicious clients may preserve clean accuracy while inducing attacker-chosen behavior on triggered inputs [19], [20]. Post-hoc and input-level backdoor detectors, including Neural Cleanse, STRIP, and spectral signatures, study complementary forms of behavioral inspection [21]–[23]. These defenses are important, but they are not a complete substitute for finality in DFL: a node also needs to know whether an update origin has sufficient provenance and whether the network agrees that it should be eligible for aggregation. A second line of work introduces distributed ledgers [24], [25] into FL. Blockchain-assisted FL systems use tamperevident records, smart contracts, or consensus mechanisms to reduce reliance on a trusted coordinator [26]–[32]. DAG and sharded ledgers reduce some serialization costs by allowing concurrent approvals or shard-level processing, as in ChainFL, DAG-FL, DAG-EnseFL, and DAGBFL [33]–[36]. IronForge further studies open and fair decentralized FL through committee-based validation and settlement [37]. These systems improve auditability, but in most cases the ledger remains a separate coordination layer: model updates are submitted to a block, shard, DAG ledger, or committee, and that external mechanism decides admission. The gap is therefore not simply the absence of a DAG ledger. The gap is the lack of a gossip-native consensus layer for DFL. In serverless FL, scalability comes from locality: each node exchanges information with a small neighborhood. If finality requires broad model
2
TABLE I: Feature-level positioning of gspDAG-FL relative to representative decentralized and ledger-assisted FL systems. Here △ denotes partial support. System family
Vote type
Validation
Bottleneck
Serverless gossip: D-PSGD, AD-PSGD, GossipFL, FedDual [7], [8], [11], [12]
3
7
None
None
Local / none
No finality
Blockchain FL [29]
BLADE-
7
7
Block update
PoW
Public
Blocks
DAG / sharded ledger FL: ChainFL, DAG-FL, DAGEnseFL, DAG-BFL [33]–[36]
△
7
Ledger update
Ledger shard
/ Public
Committee-based IronForge [37]
△
7
Committee model
Committee
3
3
Origin tuple
Virtual cert.
gspDAG-FL
Local payload Gossip-derived finality Finality object
FL:
open
FL:
dissemination, complete ledger visibility at all nodes, or a separate global committee decision for every update, then the protocol partially reintroduces the coordination bottleneck that gossip was meant to avoid. Hashgraphstyle consensus suggests a different direction: the communication history itself can form a DAG, and virtual voting can infer local confirmation from gossip-aboutgossip metadata [38]. Classical Byzantine fault-tolerant consensus relies on quorum intersection for safety [39]; Hashgraph adapts this principle to a gossip DAG. The question is how to adapt this principle to FL so that the control plane certifies provenance-admissible model origins while the data plane remains local and peer-topeer. This paper proposes gspDAG-FL, a secure DFL framework that derives finality from the same gossip history used to disseminate models. Nodes exchange model payloads only through one-hop neighbor gossip. In parallel, compact signed event certificates and receiver-endorsed accepted gossip proofs are forwarded to full nodes, which reconstruct a Topology DAG and run virtual voting over communication history. The resulting finality is over unique model-origin tuples, not over identical local parameter states. Each node aggregates only the certified models that it has locally observed and stored, so locality is preserved while invalid origins are filtered through a global provenance-admissibility decision. The key distinction is the source of finality. Existing ledger-assisted FL systems finalize submitted updates through block, shard, DAG-ledger, or committee state. In contrast, gspDAG-FL finalizes model-origin tuples from signed gossip-history proofs. Thus, model tensors remain on local peer-to-peer data paths, while full nodes run virtual voting over compact topology metadata and exchange only compact confirmation certificates. The contributions are as follows. 1) We introduce a gossip-native DFL architecture in which the data plane and control plane are separated. Model tensors remain on local neighbor-to-neighbor paths, while full nodes process event certificates and accepted-proof metadata. Consensus is therefore de-
Public / PoL + Local/private
Shard sync
Settlement Proof metadata
rived from observed gossip history rather than imposed by a separate global block, shard, or committee protocol. 2) We formalize the adversarial setting for decentralized FL with learning-clean, lazy, Byzantine, and controlcorrect nodes. We derive the local update rule from a consensus-constrained optimization view, state the required mixing and smoothness assumptions, and clarify that global finality concerns unique origin tuples rather than identical per-node parameters. 3) We design a multi-stage admission pipeline. Payload validation rejects stale, abnormally large, or directionally inconsistent updates before forwarding; acceptedproof validation prevents forged topology edges and equivocation; and post-consensus private semantic audit removes behaviorally anomalous confirmed models before aggregation. 4) We establish theoretical properties of the control and learning planes. Under stated quorum and delivery assumptions, virtual voting is well-defined, full-node certificates satisfy safety, and termination follows once enough valid origins are disseminated. We also give a convergence statement for certified perturbed gossip under time-varying effective mixing. 5) We evaluate gspDAG-FL on image classification and language modeling under Byzantine and lazy participation. The experiments use the same effective training budget for all methods, include network sizes up to N = 100, and report learning quality, detection rates, ripple dynamics, latency, throughput, and convergence rounds. The remainder of the paper is organized as follows. Sec. II reviews centralized, decentralized gossip-based, and ledger-assisted FL protocols, and introduces the adversarial and optimization setting. Sec. III presents the gspDAGFL architecture, including light-node and full-node roles, the Topology DAG, and the epoch workflow. Sec. IV specifies validation, virtual voting, finality, robustness, complexity, and the learning guarantee. Sec. V reports the simulation setup and results. Sec. VI concludes the paper. The appendices contain the technical proofs.
3
Node i initializes θit,0 = θit−1 and performs
II. Federated Learning Protocols A. Conventional FL Suppose that N nodes participate in FL. Node i holds local data Di and defines Fi (θ) ≜ Ex∼Di [Li (x; θ)] , (1) where θ is the model parameter. In the benign setting, the goal is N 1 X Fi (θ). (2) min F (θ) ≜ θ N i=1 We distinguish learning behavior from control-plane behavior. Let HL , Z, and B denote the learning-clean, lazy, and Byzantine node sets, respectively. Learningclean nodes perform fresh local training and follow the protocol. Lazy nodes are control-correct but may replay stale updates. Byzantine nodes may send arbitrary payloads or equivocate, subject only to cryptographic authentication. The control-correct set is Cctrl = {1, . . . , N } \ B. The learning target is the learning-clean objective 1 X min FHL (θ) ≜ Fi (θ). (3) θ |HL | i∈HL
The protocol does not know these sets. Its validation and consensus layers aim to certify enough fresh, nonByzantine origins while excluding stale or inconsistent origins. In conventional FL [1], [4], as shown in Fig. 1(a), a central server coordinates all nodes. At epoch t, node i starts from the current global model θit,0 = θt−1 and performs K local stochastic-gradient steps: t,k θit,k+1 = θit,k − η∇Li xt,k ; θ , k = 0, . . . , K − 1. (4) i i The server aggregates N X wi θit,K , θt =
wi > 0,
i=1 t
N X
(8)
k = 0, . . . , K − 1. After K local steps, ĝit = ĝit−1 −
1 t,K θi − θit−1 , λ
(9)
and zit = θit,K − λĝit−1 . (10) A one-hop gossip aggregation would then take the form X X wij zjt , wij ≥ 0, wij = 1. (11) θit = j∈Ni+
j∈Ni+
For nominal decentralized convergence, the graph is / Ni+ , and W = [wij ] is doubly connected, wij = 0 if j ∈ stochastic: W 1 = 1, 1⊤ W = 1⊤ . (12) Its disagreement factor satisfies 1 ρ ≜ W − 11⊤ < 1. (13) N 2 We also assume that learning-clean losses are L-smooth, stochastic gradients have bounded variance, and data heterogeneity is bounded: 1 X 2 ∥∇Fi (θ) − ∇FHL (θ)∥2 ≤ ζ 2 . (14) |HL | i∈HL
In gspDAG-FL, the final aggregation matrix is timevarying because certified and post-audit origin sets differ across nodes; this is handled explicitly in Sec. IV-D.
C. FL over Blockchain wi = 1,
(5)
i=1
and broadcasts θ to all nodes. B. Gossip-based Decentralized FL Gossip-based DFL removes the central server by allowing each node to exchange models only with a neighbor set. Let G = (V, E) be the communication graph, Ni the neighbors of node i, and Ni+ = Ni ∪ {i}. The consensus-constrained optimization form underlying decentralized training is N X min Fi (θi ) s.t. θi = θj , ∀(i, j) ∈ E. (6) {θi }N i=1
t,k θit,k+1 = θit,k − η ∇Li xt,k − ĝit−1 i ; θi ! 1 t,k t−1 θ − θi , + λ i
Blockchain integration provides a tamper-evident ledger for recording updates and a consensus mechanism for selecting accepted updates [28], [29]. In each epoch, after local training using (4), node i signs and broadcasts θit,K as a transaction. Other nodes or miners validate received updates, often using a public validation set. Accepted updates are included in a block, and the block records both accepted transactions and an aggregate. This improves auditability relative to a trusted server, but global propagation, block construction, and confirmation delay introduce latency and throughput bottlenecks that are restrictive for gossip-native DFL.
i=1
The update used below can be interpreted as a linearized proximal primal–dual step for (6). At epoch t, node i approximately minimizes 1 Fi (θ) − ⟨ĝit−1 , θ⟩ + ∥θ − θit−1 ∥22 , (7) 2λ where ĝit−1 is a local dual/tracking variable and λ > 0 controls the proximal consensus pull.
(a) Traditional cen- (b) tralized FL DFL
Gossip-based (c) Blockchain-based FL
Fig. 1: Communication protocols for different FL approaches.
4
III. Gossip-based FL Over Hashgraph DAG (gspDAG-FL) A. System Architecture In gspDAG-FL, all nodes train and gossip as light nodes, while a subset F ⊆ {1, . . . , N } also act as full nodes. Full nodes reconstruct a Topology DAG from compact certificates and run virtual voting over that DAG. The data channel carries model payloads between neighbors. The control channel carries event certificates, accepted gossip proofs, equivocation reports, confirmation vectors, and termination certificates. The control plane certifies provenance-admissible origin tuples. It does not certify that a model is semantically safe, and it does not force all local parameters to be identical. Semantic safety is checked locally after finality; aggregation eligibility is therefore the result of both control-plane certification and private post-consensus audit. 1) Events, origin tuples, and edge convention: Each epoch t is divided into ripples r = 0, 1, . . . , Rt . Node i creates one signed event certificate per ripple: χti (r) = Sigi i, t, r, hti (r − 1), type, meta , where hti (r − 1) = h(eit (r − 1)) is the receiver selfparent hash. This certificate is sent to full nodes every ripple, including empty ripples. Thus, full nodes can reconstruct both non-empty events and empty heartbeat events. Empty events have a self-parent but no gossip parent. The genesis event eti (0) contains the corrected model zit . Its unique model-origin tuple is ωit ≜ i, t, h(eti (0)), h(zit ) . (15) All finality decisions are over tuples ω, not over bare node IDs. If full nodes observe two conflicting genesis tuples with the same origin node and epoch, that origin is marked equivocated for epoch t, and all conflicting tuples from that origin are excluded from certification. For an accepted transmission from sender a to receiver i in ripple r, the sender first signs a send proof t,send πa→i (r) binding sender, receiver, epoch, ripple, sender-parent hash h(eta (r − 1)), receiver self-parent hash h(eti (r − 1)), origin tuple ω, and model hash. If node i verifies the proof, validates the payload, and has not already observed ω, it signs a receiver endorsement σit,recv (r) over the same metadata and an acceptance flag. The accepted proof is t,send (r), σit,recv (r), χti (r) . Πta→i (r) = πa→i A duplicate origin tuple is not counted again for readiness; the receiver creates a heartbeat event instead of a new origin-observation event. If the same receiver signs multiple distinct event certificates for the same epoch and ripple, full nodes mark the receiver as equivocating and discard the conflicting event certificates for that decision instance.
node 1
node 2
node 3
node 4
Ripple 4
e1(4)
e2(4)
e3(4)
e4(4)
Ripple 3
e1(3)
e2(3)
e3(3)
e4(3)
Ripple 2
e1(2)
e2(2)
e3(2)
e4(2)
Ripple 1
e1(1)
e2(1)
e3(1)
e4(1)
Ripple 0
e1(0)
e2(0) 1
e3(0)
e4(0)
Fig. 2: Illustration of the proposed Topology DAG with N = 4 nodes over five ripples. Cross-column solid edges denote accepted gossip-parent links; same-column dashed edges denote self-predecessor links. Colors indicate moment values. Redoutlined events are voting events, and dashed circles denote empty heartbeat events.
We use the parent-to-child edge convention. A self edge is eti (r − 1) −→ eti (r), and an accepted gossip-parent edge is eta (r − 1) −→ eti (r). Hence, all DAG edges increase the ripple index, so the graph is acyclic. Virtual voting uses ancestor reachability: event e sees event u if there is a directed path u →⋆ e, equivalently if one reaches u by following parent links backward from e. B. Light-node Duties 1) Storage: Each light node stores its own event chain, accepted payloads, observed origin tuples, and received parent payloads needed for validation, forwarding, audit, and aggregation. It does not store the full Topology DAG. Model tensors therefore remain distributed along dataplane paths rather than being replicated at every node. 2) Communication: At ripple r ≥ 1, if node i has a non-empty event eti (r − 1), it selects a neighbor j ∈ Ni , sends the stored model payload and a fresh send proof, and then creates its own event certificate. If it has no payload to forward, it still creates and sends a heartbeat event certificate to full nodes. A receiver accepts at most
5
one incoming payload per ripple under a deterministic tie rule. It rejects invalid, stale, duplicate, or conflicting payloads and creates a heartbeat event in that ripple. C. Full-node Duties Full nodes verify event certificates, send proofs, receiver endorsements, self-parent hashes, gossip-parent hashes, origin tuples, and duplicate/equivocation rules. Valid event certificates add vertices and self edges to the Topology DAG. Valid accepted proofs add gossip-parent edges. Invalid messages are ignored and, if equivocation is detected, the conflicting creator or origin is marked invalid for the corresponding epoch. Full nodes run virtual voting locally over their reconstructed DAG prefixes. They then exchange compact signed confirmation vectors and termination certificates. Thus, virtual voting is used to infer local confirmation from DAG structure, while the full-node certificate exchange provides quorum finality. D. Workflow of gspDAG-FL Each epoch t has three stages. Stage 1: Local model update Node i initializes θit,0 = θit−1 , performs (8)–(10), obtains t zi , creates genesis event eti (0), and defines ωit from (15). Stage 2: Gossip over ripples Step 1: Data-channel gossip: Each node with a nonempty previous event sends one payload and proof to one selected neighbor. The receiver checks the proof, payload hash, duplicate rule, equivocation rule, and payload-validation tests. If accepted, it signs a receiver endorsement and records the origin tuple; otherwise it records only a heartbeat event. Step 2: Control-channel topology sync: Every node sends its event certificate to full nodes. If it accepted a payload, it also sends the accepted proof. Full nodes verify the messages and update the Topology DAG. Step 3: Termination check: Full nodes run virtual voting over provenance-admissible origin tuples. Let C t (r) be the set of control-plane certified origin tuples by the end of ripple r. If enough nodes are ready, full nodes broadcast termination certificates. A termination certificate matches on the tuple (t, r, C t (r)). DAG-prefix digests may be included for audit but are not required to match for termination, since honest full nodes can have different extra non-decisive proofs. Stage 3: Semantic audit and model aggregation Let Oit (r) be the set of origin tuples observed and stored by node i. After termination, node i forms the certifiedand-observed set Ati = C t (r) ∩ Oit (r).
It then applies the semantic audit in Sec. IV-C3, producing Aeti ⊆ Ati . t For each ω ∈ Aei , let zω denote the corresponding stored payload. Aggregation uses weights over certified observed origin tuples, not one-hop neighbor weights: t X αiω t t θit = w̃iω (16) zω , w̃iω =P t . et αiω ′ ω ′ ∈A t e ω∈A i
i
t Here αiω > 0 may encode trust, freshness, validation score, t or uniform weighting; the simulations use uniform αiω = 1. t−1 t t If Aei = ∅, node i keeps θi = θi . This avoids reusing
the one-hop matrix W for multi-hop certified origins. IV. Model Validation and Consensus
A. Consensus Process by Full Nodes Consensus is performed over origin tuples ω, not over node IDs or unconstrained model names. For notational simplicity, the epoch index is suppressed when clear. Let NF = |F|. Define 2N 2NF τN = + 1, τF = + 1. (17) 3 3 The control-plane model assumes authenticated channels, deterministic verification, fewer than NF /3 Byzantine full nodes, and at most ⌊(N − 1)/3⌋ Byzantine nodes. Lazy nodes are learning-invalid but control-correct unless explicitly stated otherwise. 1) Definitions: For an event e, let s(e) be its self-parent and P{e} its gossip parent if one exists. Since the stored edge direction is parent-to-child, u ⪯ e means u is an ancestor of e, i.e., u →⋆ e. At genesis, M{ei (0)} = 1. For an empty heartbeat event, M{ei (r)} = M{s(ei (r))}, but the event is non-voting and is not included in a reachable voting set. For a non-empty event ej (r), let M = max M{s(ej (r))}, M{P{ej (r)}} . (18) The set R{ej (r)} contains the earliest reachable eligible events of moment M , with at most one event per creator. An eligible event is a genesis event if M = 1, and a nonempty voting event if M > 1. If multiple reachable eligible events of moment M are created by the same node, the one with the smallest ripple index is retained. A non-empty event is a voting event if |R{ej (r)}| ≥ τN . Its moment is M{ej (r)} =
(
M + 1, M,
if ej (r) is voting, otherwise.
(19)
(20)
For a voting event ej (r), its virtual vote on origin tuple ω is defined in (21), where g(ω) is the genesis event associated with ω. The intermediate confirmation vote is defined in (22). Let Oj (r) be the set of origin tuples observed by node j up to ripple r. Duplicates do not enlarge Oj (r).
6
2) Local confirmation and certificate exchange: Let C(r) be the certified set by the end of ripple r, with C(0) = ∅. A full node locally confirms ω ∈ / C(r − 1) if there exists a voting event ej (r) with U (ej (r), ω) = 1. Full nodes exchange compact local-confirmation vectors. An origin tuple ω enters C(r) if at least τF full nodes locally confirm it. Node j is ready if |C(r) ∩ Oj (r)| ≥ Q. (23) If at least τN nodes are ready, a full node signs a termination certificate for (t, r, C(r)). A light node terminates after receiving at least τF matching certificates. This step is a compact full-node certificate exchange; virtual voting itself is the local inference of confirmation from the Topology DAG. B. Consensus Properties The next results concern provenance finality over origin tuples. They do not assert semantic validity, and they do not assert identical local model parameters after every epoch. Proofs are in Appendix A. Lemma 1 (Well-defined virtual voting). For any finite Topology DAG constructed from valid event certificates and accepted proofs, the quantities M{e}, R{e}, V(e, ω), and U (e, ω) are uniquely defined for every event e and every non-equivocated origin tuple ω. Theorem 1 (Quorum-intersection safety). Assume authenticated communication, deterministic verification, τF = ⌊2NF /3⌋ + 1, and fewer than NF /3 Byzantine full nodes. Then two control-correct nodes cannot accept two different termination certificates for the same epoch. Theorem 2 (Virtual-voting consistency). Consider two control-correct full nodes whose Topology DAG prefixes contain the same valid event-certificate and acceptedproof set up to ripple r. Then their locally computed M, R, V, U , and local-confirmation vectors at ripple r are identical. Theorem 3 (Conditional liveness). Assume eventual delivery of valid control messages, bounded control-correct processing delay, connected control-correct gossip paths, and fewer than NF /3 Byzantine full nodes. Suppose there exists a finite ripple r⋆ at which at least τN control-correct nodes have each observed at least Q nonequivocated origin tuples that pass payload validation 1, V(ej (r), ω) = 1, 0,
U (ej (r), ω) =
and are confirmable from the valid Topology DAG. Then every control-correct node eventually receives a valid termination certificate and exits the gossip stage. C. Robustness, Complexity, and Validation Corrupted control messages are rejected because sender signatures, receiver endorsements, self-parent hashes, gossip-parent hashes, origin tuples, model hashes, epoch/ripple indices, and duplicate/equivocation rules must all verify. Lost data messages create heartbeat events and may increase the number of ripples. Lost control messages delay Topology-DAG reconstruction but cannot create false edges. Thus, loss and delay affect latency and liveness, while certificate safety follows from Theorem 1. In each ripple, each node sends at most one model payload over the data channel, giving O(N ) local payload transmissions. Each node also sends one event certificate to full nodes, and accepted payloads add accepted proofs; this costs O(N NF ) control messages per ripple. Fullnode confirmation exchange costs O(NF2 N ) bits per ripple. With cached reachability bitsets, moment computation and virtual voting cost O(N 2 ) bit operations per full node per ripple. The Topology DAG stores O(N Rt ) event metadata per epoch. 1) Payload validation: If node i receives zω , it first computes f1 (zω ) = ∥zω − θit−1 ∥2 . (24) If f1 (zω ) < ϵstale , the update is rejected as stale before any directional normalization. Otherwise, using the previously post-audit set, node i computes µ1i , σi1 and rejects if f1 (zω ) < L1i or f1 (zω ) > Ui1 , where L1i = max(ϵstale , µ1i − 3σi1 ), Ui1 = µ1i + 3σi1 . For direction, define the valid previous direction pool by excluding updates with displacement below ϵstale . If this pool is too small or if the mean direction norm is below ϵdir , the directional filter is skipped for the current epoch and only the magnitude rule is used. Otherwise, ⟨zω − θit−1 , d¯t−1 ⟩ i f2 (zω ) = , (25) t−1 ∥zω − θi ∥2 where dit−1 , d¯it−1 = t−1 ∥di ∥2 and dit−1 is the average normalized direction over the valid previous pool. Node i rejects if f2 (zω ) < L2i = µ2i − 3σi2 .
M{ej (r)} = 2 and g(ω) ∈ R{ej (r)}, X M{ej (r)} > 2 and V(e, ω) > |R{ej (r)}|/2,
(21)
e∈R{ej (r)}
otherwise. 1, 0,
M{ej (r)} > 2 and
X e∈R{ej (r)}
otherwise.
V(e, ω) ≥ τN , (22)
7
These filters are first-stage screens inspired by trust and asynchronous robust validation [40], [41], not universal Byzantine detectors. Proposition 1 (False-rejection control under concentrated honest statistics). Fix node i and statistic fm , m ∈ {1, 2}. Suppose learning-clean values of fm are sub-Gaussian with mean µ̄m and scale σ̄m , and suppose the empirical estimates satisfy |µm |σim − σ̄m | ≤ εσ i − µ̄m | ≤ εµ , with probability at least 1 − δn . Then the false-rejection probability is bounded by (3σ̄m − 3εσ − εµ )2+ Pr{clean rejection} ≤ δn +cm exp − , 2 2σ̄m with c1 = 2 for the two-sided magnitude test and c2 = 1 for the one-sided directional test. 2) Accepted-proof validation: Each node has a signing key and a public verification key. Full nodes insert an event only if the event certificate χti (r) is valid and its self-parent is consistent. A gossip-parent edge is inserted only if the accepted proof Πta→i (r) verifies both the sender proof and receiver endorsement. Duplicate event certificates from the same creator in the same epoch/ripple trigger an equivocation mark. Conflicting genesis tuples from the same origin and epoch also trigger an equivocation mark and are excluded from certification. Standard Ed25519 signatures can implement these checks [44], [45]. 3) Semantic consistency audit: After control-plane finality, node i audits each locally stored zω ∈ Ati using a private trigger-free validation set Di . Let o(x; z) denote the output vector of model z. Node i computes di (zω ) = max o(x; zω ) − o(x; θit−1 ) 2 . (26) x∈Di
It removes updates whose score exceeds median + 3 MAD, following robust outlier practice [42], [43]. If |Ati | < 4, pruning is skipped. If all models exceed the threshold, the model with the smallest di is retained. This audit assumes the previous local reference has not already drifted beyond the audit tolerance; under persistent reference poisoning, the audit becomes empirical. Proposition 2 (Semantic separation). Let Hit and Bit be the learning-clean and Byzantine tuples in Ati . Suppose |Bit | < |Ati |/2, and there exist ati < bti such that di (zω ) ≤ ati , ω ∈ Hit , di (zω ) ≥ bti , ω ∈ Bit . t t t t If bi > medi +3 MADi ≥ ai , then the MAD audit removes all Byzantine tuples in Bit and retains all learning-clean tuples in Hit . D. Learning Effect of Certified and Filtered Aggregation P Let H = |HL | and θ̄t = H −1 i∈HL θit . Let Wteff be the row-stochastic effective aggregation matrix induced by the certified observed set and the post-audit weights in (16), restricted to learning-clean nodes and with invalid residual influence represented as a perturbation. We assume the effective mixing condition i h E
2
P Wteff 2 Ft ≤ ρ2 < 1,
(27)
where P = I − H −1 11⊤ and Ft is the training-history filtration before aggregation at epoch t. This assumption replaces the fixed-matrix condition in ordinary DFL and matches the filtered, time-varying aggregation used by gspDAG-FL. We also assume the primal–dual tracking error is bounded: K−1 2 1 X X t,k t,k E E[gi | Ft ] − ∇Fi (θi ) HK 2 (28) i∈H k=0 L
≤ cλ (Ωt + δt2 ), t,k where gi is the stochastic gradient including the primal– dual correction, Ωt is the learning-clean disagreement energy defined in Appendix B, and cλ < ∞. Let ξit = ηKbti be the parameter-space aggregation perturbation, with 1 X E∥bti ∥22 ≤ δt2 . H i∈HL
Theorem 4 (Stationarity under certified time-varying gossip). Assume learning-clean losses are L-smooth and lower bounded, stochastic gradients have variance at most σg2 , heterogeneity is bounded by ζ 2 , (27) holds, and the tracking condition (28) holds. For sufficiently small η, T −1 i FHL (θ̄0 ) − Finf 1 X h 2 E ∇FHL (θ̄t ) 2 ≤ O + O(ησg2 ) T t=0 ηKT ηKζ 2 +O (1 − ρ)2 ! T −1 1 X 2 +O δ . (29) T t=0 t Thus, with η = Θ(T −1/2 ) and bounded average perturbation, gspDAG-FL converges to a stationary neighborhood of FHL . V. Simulation Results This section evaluates gspDAG-FL in terms of learning quality, robustness, detection effectiveness, ripple dynamics, and ledger scalability. The experiments test whether gspDAG-FL preserves model quality under invalid participation, whether the validation stages remove different attack types, and whether the DAG control plane scales better than block-centric coordination. A. Simulation Setup 1) Experimental environment and baselines: For gspDAG-FL, the ledger layer is implemented by extending the dagsim Hashgraph simulator [46] in Kotlin with JDK 17+ and Gradle. We augment events with origin tuples, payload hashes, event certificates, and accepted proofs. Full-node Topology-DAG processing uses JGraphT [47], and signature verification uses Ed25519 primitives from BouncyCastle [48]. Local learning and validation use Python 3.10, PyTorch [49], and NumPy [50]. Data and control channels are bidirectional gRPC streams using gRPC-Kotlin, grpcio, and Protocol Buffers [51]– [53]. Experiments are orchestrated with Docker Compose, logged to CSV, and visualized using matplotlib [54].
8
TABLE II: Baseline adaptation.
TABLE III: Simulation configuration.
Method
Topology
Finality
Validation
Parameter
Default / sweep value
AD-PSGD BLADE-FL ChainFL gspDAG-FL
same gossip graph ledger broadcast shard/main ledger local gossip
none PoW block shard+DAG commit origin certificate
none/local averaging public held-out set public held-out set local/private audit
Tasks Baselines Default nodes Network-size sweep Target Byzantine ratio Target lazy ratio Full-node ratio Readiness threshold Ripple cap Local SGD Network heterogeneity Invalid-origin types
MNIST; Penn Treebank AD-PSGD, BLADE-FL, ChainFL N = 15 5, 10, 15, 20, 25, 30, 50, 75, 100 µ = 0.15 default γ = 0.10 default 0.40 Q = ⌊2N/3⌋ + 1 Rtmax = Q + 2 B = 50, K = 5, η = 0.01, λ = 100 10–50 Mbps, 50–200 ms magnitude, directional, semantic, lazy replay
Large parameter sweeps and ripple-process stress tests use a trace-driven simulator with the same event transition, proof verification, duplicate, equivocation, and certification rules. Random seeds are fixed in each script. AD-PSGD uses the public stochastic_gradient_push implementation [55]. BLADE-FL uses its public implementation [56] over a local Ganache Ethereum testnet [57]. ChainFL uses the public ChainsFL implementation [58]. Table II summarizes the adaptation of baselines. 2) Data, tasks, and fairness: Task 1 is MNIST image classification [59], using a lightweight CNN based on MobileNetV2 [60]; performance is clean test accuracy. Semantic attacks use a 3 × 3 white square trigger and target class 0. Task 2 is Penn Treebank language modeling [61], using a GRU next-word predictor; performance is clean test perplexity. Semantic attacks insert a fixed rare twoword trigger and force a target token. All methods use the same effective training budget. The training pool is common to all methods. Public validation data for BLADE-FL and ChainFL and private audit data for gspDAG-FL are drawn from held-out samples and are not used for training. AD-PSGD does not use validation data. Final metrics use the same disjoint test split. 3) Fault model, topology, and metrics: Unless otherwise stated, the default setting is N = 15, target adversarial ratio µ = 0.15, target lazy ratio γ = 0.10, full-node ratio 0.40, Q = ⌊2N/3⌋ + 1, and Rtmax = Q + 2. Integer assignment uses B = min{⌊µN ⌋, ⌊(N − 1)/3⌋}, Z = ⌊γN ⌋, with disjoint Byzantine and lazy sets. Lazy nodes are control-correct unless explicitly marked otherwise. In highfault sweeps, the labels µ, γ denote target ratios after this integer assignment. For N = 5, the 0.40 full-node ratio gives NF = 2, so the full-node Byzantine bound permits no Byzantine full node; the simulation enforces this by sampling full nodes from the control-correct set. For gspDAG-FL and AD-PSGD, the communication graph is a connected Watts–Strogatz small-world graph generated with NetworkX [62]. The degree is k = 8 for N ≤ 20, k = 10 for 21 ≤ N ≤ 30, and k = 12 for N ≥ 50. The rewiring probability is p = 0.25 for N < 10, p = 0.20 for 10 ≤ N ≤ 30, and p = 0.18 for larger networks. BLADE-FL and ChainFL use their native complete or shard-level communication structures. Local learning uses B = 50, K = 5, η = 0.01, and λ = 100. Node bandwidths are sampled between 10 and 50 Mbps, and latencies between 50 and 200 ms. Detection trials use 20 independent runs. Convergence is declared when |Lt − Lt−1 | < 10−3 (30) Lt−1 t for five consecutive epochs, where L is the trimmed mean
of node-local losses after removing the highest and lowest 10%. Latency is time for update exchange plus finality. Throughput is the number of correctly validated learningclean updates included per consensus round. B. Results and Analysis 1) Learning behavior and robustness: Fig. 3 shows representative training-loss trajectories of gspDAG-FL. Higher Byzantine participation raises the final loss floor because Byzantine updates perturb direction or semantics. Higher lazy participation mainly slows convergence because stale replays reduce origin freshness but do not necessarily push the model in a malicious direction. Table IV reports learning performance as N increases. gspDAG-FL stays close to ChainFL and BLADE-FL because all three schemes include update-admission mechanisms. AD-PSGD is weaker because it has no finality layer; once a poisoned or stale update is locally averaged, later gossip can propagate its effect. At larger N , gspDAGFL benefits from a larger pool of learning-clean origins while the Topology DAG prevents most invalid origins from becoming control-plane certified. Table V separates adversarial and lazy effects. Increasing µ causes sharper degradation than increasing γ, especially for Task 2. BLADE-FL and ChainFL remain robust, but their validation is tied to public-set admission and heavier ledger coordination. gspDAG-FL retains comparable learning quality while preserving local payload paths. 2) Validation pipeline and ripple dynamics: Table VI reports end-to-end detection rates and false alarms. The false-alarm rate stays below 0.4%, so robustness is not obtained by discarding many learning-clean updates. Table VII shows how stages contribute over time: magnitude filtering dominates early, directional detections rise after the direction reference stabilizes, and semantic detections become more important after finality. Fig. 4 shows the per-epoch ripple count Rt . Clean regimes stay close to the useful receive-opportunity lower bound Q − 1. Adversary-heavy regimes need more ripples because invalid origins are rejected before contributing to readiness. Lazy-heavy regimes also increase Rt , but less sharply, because control-correct forwarders can still carry fresh origins. 3) System scaling: Table IX reports normalized latency, throughput, and convergence rounds. Each value is nor-
9
8 1 6
0.8 0.6
4
0.4 0.2
2 0 0
50
100
150
0
20
40
60
(a) Task 1.
80
100
120
140
160
180
(b) Task 2.
Fig. 3: Training-loss dynamics of gspDAG-FL under different Byzantine and lazy-node compositions. TABLE IV: Learning performance versus network size under fixed target µ = 0.15 and γ = 0.10. Best values are bolded. Task
Method
Number of nodes N 5
10
15
20
25
30
50
75
100
Task 1 Acc. ↑
gspDAG-FL AD-PSGD BLADE-FL ChainFL
0.935 0.900 0.932 0.936
0.958 0.915 0.954 0.957
0.972 0.930 0.969 0.973
0.976 0.940 0.973 0.975
0.979 0.945 0.977 0.980
0.981 0.950 0.978 0.980
0.984 0.954 0.980 0.983
0.986 0.957 0.982 0.984
0.987 0.959 0.983 0.985
Task 2 PPL. ↓
gspDAG-FL AD-PSGD BLADE-FL ChainFL
152.0 180.0 156.0 153.0
140.0 170.0 143.0 139.0
134.0 164.0 137.0 133.0
131.0 160.0 135.0 132.0
128.0 158.0 131.0 129.0
126.0 156.0 129.0 127.0
121.4 154.2 124.7 122.6
117.6 152.8 122.3 119.4
115.3 151.6 120.8 118.1
TABLE V: Robustness under adversarial and lazy participation at N = 15. Best values are bolded. Target adversarial ratio µ, fixed γ = 0.10
Target lazy ratio γ, fixed µ = 0.15
Task
Method
0.05
0.10
0.15
0.20
0.25
0.30
0
0.05
0.10
0.15
0.20
0.25
0.30
Task 1 Acc. ↑
gspDAG-FL AD-PSGD BLADE-FL ChainFL
0.982 0.945 0.980 0.981
0.977 0.938 0.976 0.978
0.972 0.930 0.971 0.971
0.966 0.918 0.965 0.967
0.958 0.900 0.957 0.959
0.946 0.870 0.944 0.945
0.975 0.938 0.973 0.974
0.973 0.934 0.971 0.972
0.972 0.930 0.969 0.971
0.970 0.925 0.967 0.969
0.968 0.920 0.964 0.967
0.966 0.915 0.962 0.965
0.963 0.910 0.959 0.962
Task 2 PPL. ↓
gspDAG-FL AD-PSGD BLADE-FL ChainFL
128.0 150.0 130.0 129.0
131.0 157.0 132.0 130.0
134.0 164.0 136.0 135.0
140.0 176.0 141.0 139.0
148.0 192.0 150.0 149.0
160.0 215.0 162.0 159.0
132.0 160.0 134.0 133.0
133.0 162.0 135.0 133.0
134.0 164.0 136.0 134.0
135.0 167.0 138.0 136.0
136.0 170.0 140.0 137.0
138.0 173.0 142.0 139.0
139.0 176.0 144.0 140.0
10
20
70
80
13
13
12
12
11
11
10
10 10
20
30
40
50
60
70
80
90
100
(a) Task 1.
30
40
50
60
90
100
(b) Task 2.
Fig. 4: Ripple dynamics of gspDAG-FL for N = 15, Q = 11, and Rtmax = 13. TABLE VI: End-to-end defense-pipeline summary under N = 15, target µ = 0.15, and target γ = 0.10. Counts are mean ± standard deviation over 20 runs. Task Task 1 Task 2
Detection rate False alarm Detected / flawed 96.1% 95.7%
0.35% 0.34%
432.6 ± 13.3 / 450 502.6 ± 14.6 / 525
malized by the same method’s value at N = 5, so the table reports scaling trend rather than absolute hardwarespecific latency. gspDAG-FL keeps model tensors on local
gossip paths and sends only metadata through the fullnode control plane. BLADE-FL globally propagates transactions and waits for block confirmation. ChainFL reduces the bottleneck through sharding, but shard consensus and main-chain commitment still add synchronization overhead. The throughput trend is the clearest system-level effect. Increasing N increases the number of local model origins available per epoch. In gspDAG-FL, these origins do
10
TABLE VII: Cumulative invalid-origin detection by validation stage. Quantity
Task 1 epochs
Stage 20
40
60
80
Task 2 epochs 100 24
48
72
96
120
Magnitude 38 72 101 128 150 50 94 134 164 180 Direction 16 34 54 72 88 18 40 62 86 104 Cumulative count Semantic 3 8 17 30 50 1 4 12 24 61 Undetected 3 6 8 10 12 3 6 8 14 15 Detected total 57 114 172 230 288 69 138 208 274 345 Invalid origins
60 120 180 240 300 72 144 216 288 360
TABLE VIII: Ripple statistics for N = 15, Q = 11, and Rtmax = 13. Task 1
Regime
med. mean µ = 0, γ = 0 µ = 0.20, γ = 0.10 µ = 0.10, γ = 0.20
11 12 11
Task 2 cap
10.84 3.7% 11.91 12.4% 11.27 7.3%
med. mean 12 13 12
cap
11.13 8.6% 12.28 24.7% 11.62 13.9%
not become all-to-all tensor broadcasts; only their signed provenance enters the control plane. Hence, more participants increase useful update diversity without creating the same confirmation bottleneck as block-centric ledgers. The results support four conclusions. First, gspDAG-FL achieves learning quality comparable to validation-based ledger FL while preserving gossip-level model exchange. Second, Byzantine faults are more damaging than lazy faults because they alter update direction and semantics, not only freshness. Third, the validation stages are complementary. Fourth, the Topology DAG gives global provenance finality over origin tuples without forcing all nodes to hold identical model tensors in every epoch. VI. Conclusion This paper introduced gspDAG-FL, a secure decentralized federated learning framework that derives finality from gossip history rather than from a separate block, shard, or committee layer. Model payloads remain on local peer-to-peer paths, while full nodes use event certificates and receiver-endorsed accepted gossip proofs to reconstruct a Topology DAG and run virtual voting over provenance-admissible origin tuples. This gives global finality over which origins may be considered for aggregation without requiring identical local model states at all nodes. The framework combines payload validation, acceptedproof validation, and private semantic audit to limit stale, malformed, and behaviorally abnormal updates. We proved well-definedness, quorum-intersection safety, virtual-voting consistency, conditional liveness, and a convergence guarantee under time-varying certified aggregation. Simulations on image classification and language modeling show that gspDAG-FL preserves learning quality close to validation-based ledger FL while improving latency, throughput, and scalability under Byzantine and lazy participation in the tested range up to N = 100. Future work will study dynamic churn, adaptive fullnode selection, stronger privacy for proof and audit metadata, and deployment under real edge-network traces.
Appendix A Proofs of Consensus Properties For an event e, let cr(e) denote its creator and rip(e) its ripple. With the parent-to-child edge convention, u ⪯ e means u →⋆ e. Thus u is an ancestor visible from e by following parent links backward. Since all stored edges increase ripple index, the DAG is acyclic. Validity of event certificates and accepted proofs includes all signatures, endorsements, hashes, identities, origin tuples, and duplicate/equivocation checks. A. Proof of Lemma 1 At ripple 0, all genesis moments and reachable sets are fixed. Assume all quantities are uniquely defined up to ripple r−1. For any event ej (r), its self-parent and possible gossip parent lie in earlier ripple r − 1, so their moments are unique. For a non-empty event, the base moment M in (18) is therefore unique. The ancestor relation ⪯ is determined by the verified DAG. For each creator q, the set of reachable eligible events of moment M is finite; if it is nonempty, the event with smallest ripple index is unique because a control-correct node creates at most one valid event certificate per ripple and equivocations are excluded. Hence the earliest-per-creator rule uniquely defines R{ej (r)}. The voting test and moment update are deterministic, so M{ej (r)} is unique. For an empty heartbeat event, the inherited moment from the selfparent is unique and the event is non-voting. Virtual votes are defined by induction over moment. Moment-2 votes are determined directly by whether g(ω) ∈ R{e}. For moment m > 2, the vote of a voting event depends only on reachable eligible events of moment m − 1, whose votes have already been uniquely defined. The intermediate vote is a deterministic threshold function of these lower-moment votes. Therefore V and U are uniquely defined for every voting event and nonequivocated origin tuple. This proves the lemma. B. Proof of Theorem 1 Let BF < NF /3 be the number of Byzantine full nodes. Any accepted certificate has least at 2NF τF = +1 3 signatures. Suppose two different termination certificates for the same epoch are accepted, with signer sets Q1 and Q2 . Then |Q1 ∩ Q2 | ≥ |Q1 | + |Q2 | − NF ≥ 2τF − NF .
11
TABLE IX: Normalized system scaling under fixed target µ = 0.15 and γ = 0.10. Values are normalized to each method’s value at N = 5. Best values are bolded. Task
Metric
Method
Number of nodes N
Lat. ↓
gspDAG-FL 1.000 1.194 1.297 1.456 1.538 1.624 2.071 2.637 ChainFL 1.000 1.319 1.642 1.836 2.027 2.476 3.691 5.183 BLADE-FL 1.000 1.397 1.743 2.108 2.493 2.897 4.582 6.914
3.118 6.742 9.227
Thr. ↑
gspDAG-FL 1.000 1.704 2.427 3.012 3.449 4.013 5.674 7.386 ChainFL 1.000 1.486 1.932 2.286 2.617 2.803 3.548 4.213 BLADE-FL 1.000 0.982 0.921 0.832 0.731 0.653 0.514 0.407
8.832 4.762 0.342
gspDAG-FL 1.000 0.887 0.826 0.798 0.731 0.648 0.557 0.509 Rounds ↓ ChainFL 1.000 0.981 0.969 0.958 0.979 0.991 1.048 1.116 BLADE-FL 1.000 1.071 1.163 1.257 1.382 1.553 2.036 2.571
0.476 1.184 2.924
5
Task 1
Task 2
10
15
20
25
30
50
75
100
Lat. ↓
gspDAG-FL 1.000 1.263 1.428 1.639 1.774 1.905 2.413 3.021 3.587 ChainFL 1.000 1.492 2.083 2.314 2.579 2.981 4.381 6.128 7.943 BLADE-FL 1.000 1.512 2.119 2.553 3.107 3.654 5.786 8.971 12.236
Thr. ↑
gspDAG-FL 1.000 1.518 2.083 2.571 2.962 3.301 4.764 6.137 1.000 1.331 1.527 2.004 2.118 2.347 3.093 3.671 ChainFL BLADE-FL 1.000 0.987 0.869 0.801 0.648 0.569 0.447 0.353
7.124 4.138 0.284
gspDAG-FL 1.000 0.941 0.898 0.869 0.842 0.819 0.771 0.731 Rounds ↓ ChainFL 1.000 1.032 1.018 1.041 1.073 1.103 1.182 1.268 BLADE-FL 1.000 1.052 1.129 1.231 1.421 1.704 2.247 2.768
0.704 1.354 3.164
For NF = 3k, 3k + 1, 3k + 2, direct substitution gives NF . 2τF − NF > 3 Hence |Q1 ∩ Q2 | > NF /3 > BF , so the intersection contains at least one control-correct full node. A controlcorrect full node signs at most one termination certificate per epoch. Therefore two different certificates for the same epoch cannot both gather valid quorums. This proves safety. C. Proof of Theorem 2 If two control-correct full nodes have the same valid event-certificate and accepted-proof set up to ripple r, deterministic verification gives the same vertices, self edges, gossip-parent edges, and equivocation exclusions. Therefore, the two full nodes hold the same Topology DAG prefix. By the induction argument in Lemma 1, the same DAG prefix gives identical moment values and reachable eligible sets. Since the vote and intermediate-confirmation rules are deterministic functions of these sets, the two full nodes compute identical V, U , and local-confirmation vectors at ripple r. D. Proof of Theorem 3 Because fewer than NF /3 full nodes are Byzantine, at least τF full nodes are control-correct. By assumption, at ripple r⋆ , at least τN control-correct nodes have each observed at least Q non-equivocated payload-valid origin tuples that are confirmable from the valid DAG. Eventual delivery ensures that all event certificates and accepted proofs needed for these observations eventually reach every control-correct full node. Bounded processing delay ensures that they are verified and inserted into each control-correct full node’s DAG prefix in finite time. By Theorem 2, control-correct full nodes with the same decisive proof prefix compute the same confirmations for the relevant origin tuples. Once at least τF matching
confirmation vectors are exchanged, the same certified set C(r) is derived at control-correct full nodes. Since at least τN nodes satisfy |C(r) ∩ Oj (r)| ≥ Q, control-correct full nodes sign termination certificates for (t, r, C(r)). Eventual delivery of those certificates gives every control-correct node τF matching certificates, so it terminates. The proof is conditional: if the dissemination event never occurs because too many valid payloads are lost, rejected, or withheld, no protocol can force this readiness condition. Appendix B Proofs of Validation and Learning Statements A. Proof of Proposition 1 Let X = fm (z) for a learning-clean update. Let m En = {|µm i − µ̄m | ≤ εµ , |σi − σ̄m | ≤ εσ }. By assumption, Pr(En ) ≥ 1 − δn . On En , upper rejection implies X − µ̄m > 3σ̄m − εµ − 3εσ . For the two-sided magnitude test, lower rejection similarly implies µ̄m − X > 3σ̄m − εµ − 3εσ . Let am = 3σ̄m − εµ − 3εσ + . The sub-Gaussian tail inequality gives a2 Pr{X − µ̄m > am } ≤ exp − m2 , 2σ̄m and the same bound holds for the lower tail. Therefore, by the union bound, a2 Pr{clean rejection for f1 } ≤ δn + 2 exp − 12 . 2σ̄1 For the directional statistic, only the lower tail isused: a2 Pr{clean rejection for f2 } ≤ δn + exp − 22 . 2σ̄2 This gives the proposition.
12
B. Proof of Proposition 2 Let Tit = medti + 3 MADti . The audit removes exactly those tuples with di (zω ) > Tit . If ω ∈ Hit , then di (zω ) ≤ ati ≤ Tit , so it is retained. If ω ∈ Bit , then di (zω ) ≥ bti > Tit , so it is removed. The honest-majority condition ensures that the median is not controlled by Byzantine scores; exact separation follows from the displayed threshold inequality. C. Proof of Theorem 4 Let H = |HL |, stack the learning-clean parameters as t ⊤ Θt = [θ1t , . . . , θH ] ∈ RH×d , and define J = H −1 11⊤ , P = I − J, Ωt = H −1 E∥P Θt ∥2F . The effective aggregation matrix Wteff is row-stochastic and satisfies (27). Let git,k be the stochastic gradient including the primal–dual correction. The tracking condition is (28). After K local steps and certified aggregation, the learning-clean average obeys K−1 X θ̄t+1 = θ̄t − η ḡ t,k + ηK b̄t , k=0
where ḡ t,k = H −1
X i∈HL
git,k ,
b̄t = H −1
X
bti .
i∈HL
By Jensen’s inequality, E∥b̄t ∥22 ≤ δt2 . e t+1 The disagreement recursion follows from (27). Let Θ be the post-local-SGD, pre-aggregation stack. Since Wteff is row-stochastic, e t+1 P Wteff Θ is the disagreement component after effective mixing. By (27), smoothness, bounded variance, bounded heterogeneity, and the tracking condition, 1+ρ Ωt+1 ≤ Ωt + C1 η 2 K 2 (σg2 + ζ 2 ) + C2 η 2 K 2 δt2 . 2 Iterating the recursion gives ! T −1 η 2 K 2 (σg2 + ζ 2 ) 1 X Ω0 Ωt ≤ O +O T t=0 (1 − ρ)T 1−ρ ! T −1 η2 K 2 X 2 +O δ . (1 − ρ)T t=0 t Define K−1 X Gt = K −1 ḡ t,k , et = Gt − ∇FHL (θ̄t ). k=0
Using L-smoothness, gradient variance, heterogeneity, disagreement, local drift, and tracking, ! 2 σ g + L2 Ωt + η 2 K 2 L2 (σg2 + ζ 2 ) + δt2 . E∥et ∥22 ≤ C3 HK By L-smoothness of FHL , FHL (θ̄t+1 ) ≤ FHL (θ̄t ) + ∇FHL (θ̄t ), −ηKGt + ηK b̄t L 2 −ηKGt + ηK b̄t 2 . + 2
Substituting Gt = ∇FHL (θ̄t ) + et , applying Young’s inequality, and choosing ηKL sufficiently small gives EFHL (θ̄t+1 ) ≤ EFHL (θ̄t ) i ηK h 2 − E ∇FHL (θ̄t ) 2 4 + C4 ηKE∥et ∥22 + C5 ηKδt2 . Summing from 0 to T − 1, using the lower bound Finf , and substituting the bounds on et and Ωt , yields T −1 i 1 X h FHL (θ̄0 ) − Finf t 2 E ∇FHL (θ̄ ) 2 ≤ O T t=0 ηKT ηKζ 2 2 + O(ησg ) + O (1 − ρ)2 ! T −1 1 X 2 +O δ . T t=0 t
The (1 − ρ)−2 factor is the standard amplification of local drift and heterogeneity through decentralized mixing. Taking η = Θ(T −1/2 ) gives the stated stationaryneighborhood conclusion. References [1] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Agüera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proc. 20th Int. Conf. Artif. Intell. Statist. (AISTATS), 2017, pp. 1273–1282. [2] P. Kairouz et al., “Advances and open problems in federated learning,” Found. Trends Mach. Learn., vol. 14, no. 1–2, pp. 1– 210, 2021, doi: 10.1561/2200000083. [3] A. Taherpour and X. Wang, “ZK-HybridFL: Zero-knowledge proof-enhanced hybrid ledger for federated learning,” IEEE Trans. Neural Netw. Learn. Syst., early access, pp. 1–15, Feb. 2026, doi: 10.1109/TNNLS.2026.3658993. [4] K. Bonawitz et al., “Practical secure aggregation for privacypreserving machine learning,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), 2017, pp. 1175–1191, doi: 10.1145/3133956.3133982. [5] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2019, pp. 14747–14756. [6] S. Boyd, A. Ghosh, B. Prabhakar, and D. Shah, “Randomized gossip algorithms,” IEEE Trans. Inf. Theory, vol. 52, no. 6, pp. 2508–2530, Jun. 2006, doi: 10.1109/TIT.2006.874516. [7] X. Lian, C. Zhang, H. Zhang, C.-J. Hsieh, W. Zhang, and J. Liu, “Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2017, pp. 5330–5340. [8] X. Lian, W. Zhang, C.-J. Hsieh, C. Zhang, and J. Liu, “Asynchronous decentralized parallel stochastic gradient descent,” in Proc. Int. Conf. Mach. Learn. (ICML), 2018, pp. 3043–3052. [9] M. Assran, N. Loizou, N. Ballas, and M. G. Rabbat, “Stochastic gradient push for distributed deep learning,” in Proc. Int. Conf. Mach. Learn. (ICML), 2019, pp. 344–353. [10] A. Koloskova, S. Stich, and M. Jaggi, “Decentralized stochastic optimization and gossip algorithms with compressed communication,” in Proc. Int. Conf. Mach. Learn. (ICML), 2019, pp. 3478–3487. [11] Z. Tang, S. Shi, B. Li, and X. Chu, “GossipFL: A decentralized federated learning framework with sparsified and adaptive communication,” IEEE Trans. Parallel Distrib. Syst., vol. 34, no. 3, pp. 909–922, Mar. 2023, doi: 10.1109/TPDS.2022.3230938. [12] Q. Chen, Z. Wang, H. Wang, and X. Lin, “FedDual: Pair-wise gossip helps federated learning in large decentralized networks,” IEEE Trans. Inf. Forensics Security, vol. 18, pp. 335–350, 2023, doi: 10.1109/TIFS.2022.3222935. [13] H. Wang and Y. Chi, “Communication-efficient federated optimization over semi-decentralized networks,” IEEE Trans. Signal Inf. Process. Netw., vol. 11, pp. 147–160, 2025, doi: 10.1109/TSIPN.2025.3539004.
13
[14] A. Taherpour and X. Wang, “SPID-Chain: A smart contract-enabled, polar-coded interoperable DAG chain,” arXiv:2501.11794, Jan. 2025, doi: 10.48550/arXiv.2501.11794. [15] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2017, pp. 119–129. [16] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantinerobust distributed learning: Towards optimal statistical rates,” in Proc. Int. Conf. Mach. Learn. (ICML), 2018, pp. 5650–5659. [17] K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Trans. Signal Process., vol. 70, pp. 1142–1154, 2022, doi: 10.1109/TSP.2022.3153135. [18] C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv:1808.04866, 2018, doi: 10.48550/arXiv.1808.04866. [19] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proc. Int. Conf. Artif. Intell. Statist. (AISTATS), 2020, pp. 2938–2948. [20] H. Wang et al., “Attack of the tails: Yes, you really can backdoor federated learning,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2020, pp. 16070–16084. [21] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,” in Proc. IEEE Symp. Secur. Privacy (S&P), 2019, pp. 707–723, doi: 10.1109/SP.2019.00031. [22] Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “STRIP: A defence against Trojan attacks on deep neural networks,” in Proc. 35th Annu. Comput. Secur. Appl. Conf. (ACSAC), 2019, pp. 113–125, doi: 10.1145/3359789.3359790. [23] B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2018, pp. 8011–8021. [24] A. Taherpour and X. Wang, “A high-throughput and secure coded blockchain for IoT,” IEEE Trans. Dependable Secure Comput., vol. 22, no. 4, pp. 3561–3579, Jul.–Aug. 2025, doi: 10.1109/TDSC.2025.3532850. [25] A. Taherpour and X. Wang, “HybridChain: Fast, accurate, and secure transaction processing with distributed learning,” IEEE Trans. Parallel Distrib. Syst., vol. 35, no. 6, pp. 968–982, Jun. 2024, doi: 10.1109/TPDS.2024.3381593. [26] H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Blockchained ondevice federated learning,” IEEE Commun. Lett., vol. 24, no. 6, pp. 1279–1283, Jun. 2020, doi: 10.1109/LCOMM.2019.2921755. [27] S. Warnat-Herresthal et al., “Swarm learning for decentralized and confidential clinical machine learning,” Nature, vol. 594, no. 7862, pp. 265–270, Jun. 2021, doi: 10.1038/s41586-02103583-3. [28] Y. Qu et al., “Decentralized privacy using blockchainenabled federated learning in fog computing,” IEEE Internet Things J., vol. 7, no. 6, pp. 5171–5183, Jun. 2020, doi: 10.1109/JIOT.2020.2977383. [29] J. Li et al., “Blockchain assisted decentralized federated learning (BLADE-FL): Performance analysis and resource allocation,” IEEE Trans. Parallel Distrib. Syst., vol. 33, no. 10, pp. 2401–2415, Oct. 2022, doi: 10.1109/TPDS.2021.3138848. [30] Z. Cai, J. Chen, Y. Fan, Z. Zheng, and K. Li, “Blockchainempowered federated learning: Benefits, challenges, and solutions,” IEEE Trans. Big Data, vol. 11, no. 5, pp. 2244–2263, Oct. 2025, doi: 10.1109/TBDATA.2025.3541560. [31] Z. Peng et al., “VFChain: Enabling verifiable and auditable federated learning via blockchain systems,” IEEE Trans. Netw. Sci. Eng., vol. 9, no. 1, pp. 173–186, Jan.–Feb. 2022, doi: 10.1109/TNSE.2021.3050781. [32] A. P. Kalapaaking, I. Khalil, X. Yi, K.-Y. Lam, G.-B. Huang, and N. Wang, “Auditable and verifiable federated learning based on blockchain-enabled decentralization,” IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 102–115, Jan. 2025, doi: 10.1109/TNNLS.2024.3407670. [33] S. Yuan, B. Cao, Y. Sun, Z. Wan, and M. Peng, “Secure and efficient federated learning through layering and sharding blockchain,” IEEE Trans. Netw. Sci. Eng., vol. 11, no. 3, pp. 3120–3134, May–Jun. 2024, doi: 10.1109/TNSE.2024.3361458. [34] M. Cao, L. Zhang, and B. Cao, “Toward on-device federated learning: A direct acyclic graph-based blockchain approach,”
IEEE Trans. Neural Netw. Learn. Syst., vol. 34, no. 4, pp. 2028– 2042, Apr. 2023, doi: 10.1109/TNNLS.2021.3105810. [35] J. Chen, D. Wu, S. Guo, F. Qi, and X. Qiu, “DAG-EnseFL: DAG-based asynchronous federated learning with ensemble distillation,” IEEE Trans. Big Data, vol. 11, no. 6, pp. 3342– 3355, Dec. 2025, doi: 10.1109/TBDATA.2025.3594244. [36] Q. Wang, S. Xu, R. Xu, and B. Ai, “A DAG-blockchain-assisted federated learning framework in wireless networks: Learning performance and throughput optimization schemes,” IEEE Trans. Veh. Technol., vol. 74, no. 3, pp. 5097–5113, Mar. 2025, doi: 10.1109/TVT.2024.3502444. [37] G. Yu et al., “IronForge: An open, secure, fair, decentralized federated learning,” IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 354–368, Jan. 2025, doi: 10.1109/TNNLS.2023.3329249. [38] L. Baird, “The Swirlds Hashgraph consensus algorithm: Fair, fast, Byzantine fault tolerance,” Swirlds, Tech. Rep. SWIRLDSTR-2016-01, 2016. [Online]. Available: https://www.swirlds. com/downloads/SWIRLDS-TR-2016-01.pdf. Accessed: Jul. 9, 2026. [39] M. Castro and B. Liskov, “Practical Byzantine fault tolerance,” in Proc. 3rd Symp. Operating Syst. Design Implement. (OSDI), 1999, pp. 173–186. [40] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” in Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2021, doi: 10.14722/ndss.2021.24434. [41] C. Xie, O. Koyejo, and I. Gupta, “Zeno++: Robust fully asynchronous SGD,” in Proc. Int. Conf. Mach. Learn. (ICML), ser. Proc. Mach. Learn. Res., vol. 119, 2020, pp. 10495–10503. [42] B. Iglewicz and D. C. Hoaglin, How to Detect and Handle Outliers. Milwaukee, WI, USA: ASQC Quality Press, 1993. [43] C. Leys, C. Ley, O. Klein, P. Bernard, and L. Licata, “Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,” J. Exp. Soc. Psychol., vol. 49, no. 4, pp. 764–766, Jul. 2013, doi: 10.1016/j.jesp.2013.03.013. [44] S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC 8032, Jan. 2017, doi: 10.17487/RFC8032. [45] D. J. Bernstein, N. Duif, T. Lange, P. Schwabe, and B.-Y. Yang, “High-speed high-security signatures,” J. Cryptographic Eng., vol. 2, no. 2, pp. 77–89, Sep. 2012, doi: 10.1007/s13389-0120027-1. [46] B. Schachenhofer, “dagsim: Hashgraph simulator,” GitHub https://github.com/ repository. [Online]. Available: BSchachenhofer/dagsim. Accessed: Jul. 9, 2026. [47] D. Michail, J. Kinable, B. Naveh, and J. V. Sichi, “JGraphT— A Java library for graph data structures and algorithms,” ACM Trans. Math. Softw., vol. 46, no. 2, Art. no. 16, May 2020, doi: 10.1145/3381449. [48] The Legion of the Bouncy Castle Inc., “Bouncy Castle Crypto APIs,” [Online]. Available: https://www.bouncycastle.org/. Accessed: Jul. 9, 2026. [49] A. Paszke et al., “PyTorch: An imperative style, highperformance deep learning library,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2019, pp. 8024–8035. [50] C. R. Harris et al., “Array programming with NumPy,” Nature, vol. 585, no. 7825, pp. 357–362, Sep. 2020, doi: 10.1038/s41586020-2649-2. [51] The gRPC Authors, “gRPC-Kotlin,” GitHub repository. [Online]. Available: https://github.com/grpc/grpc-kotlin. Accessed: Jul. 9, 2026. [52] The gRPC Authors, “grpcio: gRPC for Python,” PyPI. [Online]. Available: https://pypi.org/project/grpcio/. Accessed: Jul. 9, 2026. [53] Google, “Protocol Buffers documentation,” [Online]. Available: https://protobuf.dev/. Accessed: Jul. 9, 2026. [54] J. D. Hunter, “Matplotlib: A 2D graphics environment,” Comput. Sci. Eng., vol. 9, no. 3, pp. 90–95, May–Jun. 2007, doi: 10.1109/MCSE.2007.55. [55] Facebook Research, “stochastic_gradient_push: PyTorch implementation of Stochastic Gradient Push,” GitHub repository. [Online]. Available: https://github.com/facebookresearch/ stochastic_gradient_push. Accessed: Jul. 9, 2026. [56] Y.-M. Shao, “BLADE-FL: Blockchain Assisted Decentralized Federated Learning,” GitHub repository. [Online]. Available:
14
https://github.com/ElvisShaoYumeng/BLADE-FL. Accessed: Jul. 9, 2026. [57] Truffle Suite, “Ganache,” [Online]. Available: https://archive. trufflesuite.com/ganache/. Accessed: Jul. 9, 2026. [58] S. Yuan, “ChainsFL: A blockchain-based federated learning implementation,” GitHub repository, 2021. [Online]. Available: https://github.com/shuoyuan/ChainsFL-implementation. Accessed: Jul. 9, 2026. [59] Y. LeCun, C. Cortes, and C. J. C. Burges, “The MNIST database of handwritten digits,” [Online]. Available: http:// yann.lecun.com/exdb/mnist/. Accessed: Jul. 9, 2026.
[60] M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “MobileNetV2: Inverted residuals and linear bottlenecks,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), 2018, pp. 4510–4520, doi: 10.1109/CVPR.2018.00474. [61] M. P. Marcus, B. Santorini, and M. A. Marcinkiewicz, “Building a large annotated corpus of English: The Penn Treebank,” Comput. Linguistics, vol. 19, no. 2, pp. 313–330, 1993. [62] A. A. Hagberg, D. A. Schult, and P. J. Swart, “Exploring network structure, dynamics, and function using NetworkX,” in Proc. Python Sci. Conf. (SciPy), 2008, pp. 11–15.