Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning

Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning Xinyun Liua∗ , Zhi Lub∗ , Yu Chenc , Ronghua Xua a

arXiv:2608.20580v1 [cs.CR] 20 Aug 2026

Department of Applied Computing, Michigan Technological University, Houghton, MI 49931, USA b School of Computing, National University of Singapore, Singapore, 119077, Singapore c Department of Electrical and Computer Engineering, Binghamton University, Binghamton, NY 13902, USA {xinyunl, ronghuax}@mtu.edu, luzhi@ieee.org, ychen@binghamton.edu

Abstract—Federated learning (FL) is vulnerable to multi-level attacks. However, existing methods address them separately, leaving FL exposed to data leakage, unauthorized reuse, and malicious gradient manipulation. In this work, we propose an FL framework that couples keyed context-provenance watermarking with verifiable lattice-based secure aggregation of Real-World Anchored Watermarking and Lattice-Based ZeroKnowledge Secure Aggregation. At the data layer, we propose a Kerckhoffs-compliant scheme that utilizes Physical Anchor Metadata (PAM) to ensure data provenance. PAM is defined as a context-provenance token derived from trusted infrastructure data (time, location, and server ID) and then subjected to a keyed HMAC-SHA-256 transformation to produce a watermark payload that cannot be generated without the client’s secret key. We further design FMGAN, a GAN-based robust image watermarking framework that embeds this transformed payload using a feature fusion module and a Mamba-guided linear attention mechanism. At the computation layer, we adopt a lattice-based zero-knowledge secure aggregation (LZKSA) protocol that verifies key correctness, L∞ /L2 norm bounds, and cosine similarity constraints over committed gradients without revealing private updates. The RLWE-based design guarantees post-quantum security. Extensive experiments validate the complementary protection of the two layers under composite attack scenarios. To our knowledge, no prior verification workflow has jointly evaluated both layers in a hybrid, end-to-end trustworthy FL framework. Index Terms—Federated Learning, Digital Watermarking, Physical Anchor Metadata (PAM), GAN model, Zero-Knowledge Proofs, Secure Aggregation

I. I NTRODUCTION In modern AI ecosystems, Federated learning (FL) constitutes a foundational paradigm for privacy-preserving model training across distributed data silos, seeing rapid integration into safety-critical sectors such as medical imaging [38], finance [9], autonomous driving [27], and industrial inspection [30]. As FL moves from controlled laboratory settings to complex real-world deployments, establishing the authenticity and verifiable provenance of digital assets has emerged as a paramount security frontier. Despite an expansion of research in FL security, a fundamental systemic gap remains ∗ Xinyun Liu and Zhi Lu contributed equally to this work.

unresolved: existing FL defense mechanisms address either data-layer provenance or gradient-aggregation security in isolation, but never both simultaneously. This gap leaves FL systems vulnerable to attack surfaces, including data leakage, unauthorized dataset usage, and malicious model manipulation [28], [34]. Digital watermarking offers a promising solution to this data-layer challenge by embedding a persistent watermark directly into the media payload, enabling robust tamper detection and asset attribution [29]. Nonetheless, existing watermarking methodologies exhibit critical limitations. Deep learning-based approaches [2], [22] resist specific distortions like noise or JPEG compression but generalize poorly to real-world perturbations and suffer from a brittle robustness-imperceptibility trade-off. Conversely, hybrid frequency-domain methods [17] withstand geometric and signal-processing attacks but require tedious manual parameter tuning, hindering deployment in distributed environments. Finally, metadata-based schemes [43] fail as a secure root of trust; these automated tokens are easily modified or entirely stripped during transmission across platforms. Secure Aggregation (SA) has been adopted to address the model-layer challenge, in which individual gradients are encrypted, preventing the aggregator from inspecting or filtering malicious updates [13], [51]. Classical secure aggregation protocols [4] protect gradient privacy by ensuring that the server observes only aggregated updates, at the expense of verifiability and the ability to inspect anomalies. While recent Zero-Knowledge Proof (ZKP) frameworks [3], [37] restore verifiability, general-purpose SNARK or Bulletproof constructions incur prohibitive computational overhead. Furthermore, their reliance on pre-quantum cryptographic assumptions conflicts with emerging post-quantum standards like FIPS 203 [41] and FIPS 204 [42]. To address the limitations identified in both data security and gradient aggregation security, we propose a dual-layer security framework that provides end-to-end protection for federated learning. At the data layer, we introduce a Kerckhoffscompliant watermarking scheme where a physical anchor

metadata (PAM) is derived from trusted ENF infrastructure and then undergoes a keyed HMAC-SHA256 transformation to produce a watermark payload that is infeasible to generate without the secret key. This securely generated watermark is then embedded in images by FMGAN, a GAN-based framework that utilizes feature fusion and Mamba-guided linear attention. It is naturally suited for distributed learning scenarios since each node possesses its own distinctive PAM, which acts as a context-provenance token synthesized from a multi-dimensional set of environmental identifiers: time, location, and ENF server ID, retrieved directly from a trusted physical anchor infrastructure, and subsequently cryptographically transformed to ensure generation-unforgeability under key secrecy. At the computation layer, we adopt a LZKSA protocol to provide cryptographically verifiable correctness of model updates. Through zero-knowledge proofs, each client demonstrates that its committed gradients satisfy prescribed norm constraints, cosine similarity bounds, and key-correctness requirements, without revealing the gradients themselves. The RLWE-based construction ensures postquantum security while incurring substantially lower overhead than general-purpose ZKP systems such as SNARKs [5] or Bulletproofs [7]. To achieve trustworthy FL, we make the following key contributions: • To the best of our knowledge, this is the first work to construct a hybrid, end-to-end trustworthy FL framework that systematically integrates the data-security watermarking layer and the lattice-based zero-knowledge secure aggregation layer in a joint verification workflow. • We propose a keyed PAM watermarking scheme whose payloads are existentially unforgeable to generate without the secret key, even under full exposure of the algorithm and public parameters. • We design FMGAN, a GAN-based watermarking framework with a feature fusion module and a Mamba-guided linear attention mechanism for embedding cryptographically protected PAM-derived watermarks into images. • Building on the LZKSA protocol, we present a streamlined, deployment-oriented integration that adapts latticebased zero-knowledge aggregation to practical federated learning workflows, while preserving verification guarantees and reducing system complexity. • We implement and evaluate a complete end-to-end federated learning pipeline, demonstrating improved robustness against dataset leakage, unauthorized dataset usage, and gradient manipulation, while highlighting the complementary strengths of PAM watermarking and lattice-based secure aggregation. II. BACKGROUND AND R ELATED W ORK A. Image Authentication and Watermarking Image authentication approaches are broadly categorized into passive and active techniques. Passive methods detect tampering solely by analyzing statistical irregularities or forensic artifacts inherent to the digital content [45]. In converse,

active techniques embed verifiable data directly into the spatial or frequency domains during digitization [34]. This category includes cryptography, digital signatures, and watermarking for intellectual property protection and content owner identification [25]. Among active strategies, digital watermarking provides a distinct advantage by being intrinsically bound to the media payload, ensuring tamper detection and asset attribution even if external metadata is stripped [29], [48]. While watermarking spans fragile, semi-fragile, and robust paradigms, robust watermarking is uniquely suited for data ownership verification, as it guarantees payload detectability against both common signal-processing distortions and deliberate adversarial attacks [10]. B. GAN-based Watermarking methods Compared with traditional CNN-based image watermarking techniques, GAN-based watermarking methods have demonstrated superior performance in terms of robustness, invisibility, and adaptability. By leveraging adversarial training, these methods learn to embed watermarks in a data-driven manner, enabling the generator to produce watermarked images that are visually indistinguishable from the originals while remaining resilient to a wide range of distortions. This paradigm has significantly advanced the practicality of robust watermarking in real-world multimedia applications. Early representative work such as ARWGAN [20] integrates adversarial learning with encoder–decoder architectures to enhance both concealment quality and robustness. Nevertheless, its reliance on relatively complex network structures introduces higher computational overhead. MBRS [22] introduces a mini-batch-based random selection strategy, where the noise layer is randomly chosen from real JPEG compression, simulated JPEG compression, or a noise-free layer for each mini-batch. However, its robustness against other attacks such as Gaussian and median filtering shows limited improvement, and the approach incurs significantly increased training time while struggling to minimize embedding distortion. SepMark [46] proposes a multi-embedding framework that jointly supports deepfake detection and source attribution. A single encoder embeds both fragile and robust watermarks, while two separable decoders enable independent extraction for tamper detection and source tracking. Nevertheless, it relies on specific design assumptions and experimental configurations, which may limit its generalization to more diverse scenarios. Similarly, EditGuard [49] introduces a unified framework for copyright protection and tamper-agnostic localization by embedding dual watermarks, one for localization and one for ownership verification, allowing accurate recovery even under complex editing operations. However, its design relies on carefully structured editing-aware training and optimization, which introduces additional system complexity. C. Digital Multimedia Forensics Using ENF Analysis The Electric Network Frequency (ENF) represents the nominal mains frequency (50/60 Hz) whose real-time fluctuations mirror grid-wide power load variations. Because these unique

spatio-temporal traces are inadvertently imprinted onto audio or video signals during recording, they serve as a distinct spatio-temporal fingerprint for multimedia authentication and tamper detection. Grigoras [15] first demonstrated that ENF fluctuations in audio could provide definitive temporal verification. This concept was later extended by Cooper et al. [11] to video by isolating mains-powered illumination flicker. In social media contexts, existing frameworks like DEMA [40] and real-world anchors [33], [47] reconstruct ground-truth grid profiles to audit digital asset integrity. Unlike traditional software-generated metadata (e.g., device settings, locations), which is easily modified or stripped during transmission, ENF signals are bound to the physical environment—making them virtually impossible to forge and ideal for reliable leakage detection and data provenance. D. Secure Aggregation and Zero-Knowledge Proofs in FL Although federated learning (FL) restricts raw data ondevice, local updates remain vulnerable to inference attacks. Secure Aggregation (SA) mitigates this risk by ensuring the server only observes the aggregated sum of client updates, utilizing pairwise masking and dropout-resilient secret sharing to handle client unreliability at scale [4], [6], [44]. However, SA exclusively protects confidentiality and cannot prevent clients from submitting malformed or adversarial updates. Zero-Knowledge Proofs (ZKPs) complement SA by enabling clients to non-interactively prove update validity and protocol compliance (e.g., bounded norms, correct execution of a training step, or well-formed encrypted submissions) without exposing private parameters. In practice, ZKP-based FL systems prioritize optimized circuit designs and lightweight statements to reconcile the inherent trade-off between rigorous integrity guarantees and client-side computational overhead. III. P ROBLEM S TATEMENT AND T HREAT M ODEL A. System Overview We consider a standard cross-device FL setting consisting of a central server (aggregator) and a set of distributed clients. Each client holds a private local dataset and performs ondevice training to compute model updates (e.g., gradients or weight differences), which are then sent to the server for aggregation. To preserve data privacy, the server does not have access to raw training data and relies on secure aggregation to compute the global model update. In this work, we extend the conventional FL pipeline by introducing a dual-layer security architecture. At the data layer, each client embeds a cryptographically PAM watermark as an ENF-grounded provenance token into its local images before training. At the computation layer, clients participate in a LZKSA protocol, providing cryptographic proofs that their submitted gradients are wellformed and comply with predefined constraints. The server verifies these proofs before aggregating updates, ensuring that only legitimate contributions influence the global model.

B. Security Goals Our objective is to establish end-to-end trust in FL under strong and realistic adversarial assumptions. The security objectives consist of two complementary components: data authenticity and computation integrity. At the data layer, the goal is to ensure that each client’s training data is authentic and resistant to forgery or unauthorized reuse. An adversary who knows the watermarking architecture, embedding procedure, and PAM, but does not possess the client’s secret key, should not be able to generate a valid watermark with non-negligible probability. The embedded watermark must additionally remain robust under common signal-processing operations and adversarial perturbations. At the computation layer, the objective is to ensure that model updates are well-formed and compliant with the aggregation protocol without revealing private gradients. Clients must prove correctness of masking keys and adherence to predefined norm and directional constraints. These properties are verified using lattice-based zeroknowledge proofs over RLWE commitments, providing postquantum security while preserving gradient privacy. C. Threat Model At the data layer, adversaries aim to compromise clientside dataset integrity, authenticity, or provenance via device compromise or insider threats, distributing manipulated data to disrupt collaborative training or sabotage downstream forensic analysis. Regarding adversary capabilities: (1) the attacker possesses full knowledge of the watermarking architecture, embedding/extraction procedures, and public parameters, remaining blind only to the private key driving the HMACPAM transformation (with key generation and distribution assumed secure); and (2) a external trusted authority manages and validates the ENF data, preventing the adversary from arbitrarily modifying ground-truth provenance records. At the gradient and computation layer, we consider malicious FL clients that attempt to compromise the training process by submitting manipulated model updates. These adversaries may execute poisoning or backdoor attacks by deliberately scaling, reversing, randomizing, or adversarially crafting local gradients to disrupt convergence or degrade performance. Additionally, they may deviate from the secure aggregation protocol by uploading malformed payloads or encrypting updates with incorrect cryptographic keys. To mitigate these threats, the server enforces strict input validation, accepting only protocolcompliant updates accompanied by valid cryptographic proofs while rejecting all altered or malformed inputs. IV. P ROPOSED M ETHOD We propose a dual-layer security framework for FL that jointly enforces data authenticity and computation integrity throughout the training pipeline. As illustrated in Figure 1, the framework integrates a Data-Security Layer based on realworld keyed PAM watermarking with a Computation-Security Layer built upon lattice-based zero-knowledge secure aggregation (LZKSA). By operating on different yet complementary security targets, local training data and aggregated model

updates, the two layers collectively establish an end-to-end trust chain from data acquisition to global model updates.

DateTime: 23 bits Year Month Date 7 bits (0-99) 4 bits (1-12) 5 bits (1-31)

Post-quantum enhanced ZKP Verification

FL Server Global model

Gradient Verification LZKSA Protocol

ZKP Secure Aggregation

• Key Correctness • L2 Norm Verification • Cosine Similarity Verification

Hour Minute (15 mins) 5 bits (0-23) 2 bits (0-3) Location (Region): 3 bits ENF Server ID: 3 bits (0-7) Error Correction Code: 4~38 bits

Gradient Computation FMGAN Watermarking Attacker

Manipulated model

Invalid PAM

Watermark Extraction Watermark Embedding

a) DEMA Infrastructure

c) PAM Structure

Original Dataset

Win=HMACK(PAM) Manipulated dataset

Local model

...... FL Clients

Watermarked dataset with PAM

FL Framework

Anchor Verification

Physical Anchor metadata (PAM) Anchor Generation

Ground Truth Anchor Data Management Physical Anchor Fabric

Physical Power Infrastructure

Physical Anchored Watermarking Framework

b) The circuit to collect ground truth ENF data

Fig. 2. DEMA Infrastructure and PAM Data Structure.

Fig. 1. System Overview.

A. Keyed PAM Watermarking Our real-world keyed PAM watermarking framework consists of two sub-frameworks: i) a physical anchor fabric that manages ground-truth references and provides PAM generation and verification; ii) an FMGAN-based watermarking framework that embeds cryptographically protected PAMderived payloads into images and extracts them during the verification stage, as illustrated in Figure 1. To prevent adversaries from tampering with training data or creating fake digital content for illegal purposes, we employ a physical anchor fabric that generates verifiable PAMs linked to external ground-truth references, like estimated ENF fluctuations. Unlike traditional metadata that is client-generated and easily forged, our PAM is not a direct client-sensed fingerprint of the local ENF signal. Instead, it is a context provenance token built from discrete parameters: time (t), location (l), and ENF Server ID (ids), sourced from a trusted ground-truth ENF fabric such as DEMA [40]. As illustrated in Figure 2-c), these parameters are combined with an error correction code (ECC) e to form a binary string representing the environmental context at the time of recording. Figure 2-a) shows a DEMA infrastructure based on North American power transmission grid. Each regional power grid relies on a dedicated server to store and manage ground truth ENF data within its network. Figure 2-b) demonstrates a specifically designed circuit that can be used for ground truth ENF data acquisition at the region server [39]. The DEMA system allows for a regional ENF source search given time and location. Thus, it provides physical ground truths to support data authentication in cyberspace. This mechanism naturally fits federated learning scenarios, where distributed clients can anchor their data provenance to geographically localized ENF references through a context provenance token. To comply with Kerckhoffs’ principle and prevent forgery, this raw PAM structure is not embedded directly. Instead, it

undergoes a keyed cryptographic transformation defined as Win = HMACK (PAM),

(1)

where K denotes a client-side secret key created by the data owner and secretly shared with the physical anchor fabric, and HMAC is instantiated as HMAC-SHA256. Consequently, the scheme establishes a context-level anchor (a soft link) to the physical infrastructure via the context-provenance token PAM. Crucially, the watermark itself is a cryptographic hash of the provenance claim, ensuring that even if the PAM structure is public, the keyed watermark Win cannot be forged without the secret key K. Subsequently, the FMGAN framework embeds this cryptographically secured watermark Win into images. The anchor verification pipeline begins with the watermark extraction phase, which recovers the keyed watermark Win from the watermarked image and forwards it, along with auxiliary metadata, to the physical anchor infrastructure. If the extraction module fails to retrieve Win , the pipeline immediately terminates and returns a verification failure status. Upon successful extraction of Win , the physical fabric parses the auxiliary metadata to extract the temporal (t′ ) and spatial (l′ ) parameters. These parameters serve as indices to query the secure physical fabric and retrieve the corresponding reference Physical Anchor Metadata (P AM ′ ). To verify that the image matches its asserted environmental context, the system evaluates the cryptographic integrity of the asset by ′ validating the following condition:HMACK (P AM ) = Win . Upon satisfying this condition, the pipeline outputs a positive verification result, thereby certifying that the image carries a key-valid context-provenance token for the asserted time, location, and server, that is, that a holder of the secret key vouched for that context. It does not by itself certify that the image content is genuine; see Limitations. Conversely, a mismatch yields a negative verification outcome, indicating that the data has been tampered with or fabricated.

B. The Watermarking Model Client-side training data are typically heterogeneous and visually complex, encompassing diverse textures, varying color saturation levels, and inconsistent lighting conditions, thereby leading to challenges including data heterogeneity, feature inconsistency, and domain shifts [26]. The complexities make embedding watermarks more difficult, particularly in maintaining both visual invisibility and robustness. ������

Norm

Adv Loss

⊕

MGLA Block

MGLA Block

Linear Discriminator

Encoder Loss

By leveraging dense connections, the FFM facilitates feature reuse, thereby significantly enhancing the encoder’s representation capability.

Architecture of Encoder

Norm

MLP

⊕

Linear Conv

�

Linear

Linear Attention

Linear

Encoder

��� Noise

������

���

Decoder Loss

���� Decoder

���

������

Feature-Fusion Module

MGLA Module

�� ��

Linear

⊗

⊕

���

���

Global Residual Learning

⊗ Elements-wise multiplication ⊕ Add

Skip connection

Fig. 3. Architecture of FMGAN and its Encoder. The encoder includes (1) a Feature-Fusion Module (FFM) and (2) a Mamba-Guided Linear Attention Module (MGLA), which leverages linear attention to embed watermarks into low-saliency regions of the original image.

As illustrated in Figure 3, the FMGAN model consists of the encoder Eθ , the decoder Dβ , the noise layer N oise, and the discriminator DCδ . The parameters θ, β, and δ correspond to the trainable weights of the encoder, decoder, and discriminator, respectively, and are iteratively refined to improve watermark invisibility and robustness. Given an input image Fcover of size H ×W ×C and a binary watermark Win of length L, the encoder Eθ produces a watermarked image Fen . The discriminator DCδ determines how closely Fen resembles Fcover by evaluating their similarity, guiding Eθ to generate a more realistic Fen . To enhance robustness, different types of distortions are applied through N oise. Simultaneously, adversarial training is performed, where the decoder Dβ extracts the watermark Wout from the noisy image Fnoise , ensuring that Wout closely matches Win . 1) Encoder: The encoder Eθ functions to embed the watermark into the original image Fcover while maintaining high image quality and ensuring resilience against different types of attacks. To improve training efficiency, a residual structure is incorporated, featuring a global residual skip connection. Specifically, the encoded image is generated as Fen = E(Fcover , Win ), where E(·) represents the encoding process, as illustrated in Fig. 3. The encoder is composed of two primary components: the Feature Fusion Module (FFM) and the Mamba-Guided Linear Attention Module (MGLA). The FFM overcomes the drawback of capturing only a limited range of image features by extracting both shallow and deep features across multiple layers. The fused feature XW is obtained as XW = EF F M (Fcover , Win ), where EF F M denotes the operation of the FFM. The FFM consists of multiple dense blocks, each comprising Batch Normalization (BN), Rectified Linear Unit (ReLU) activation, and convolutional layers in sequence.

�

Fig. 4. Overview of the MGLA architectural design.

The way a watermark is embedded in an image can influence both its visual quality and robustness. Placing it in less noticeable areas helps maintain the image’s quality, while embedding it in textured regions strengthens its resistance to attacks. To address the challenge of distortion, we developed the Mamba-Guided Linear Attention Module (MGLA), which optimizes watermark placement to minimize visual impact (see Figure 4). Mamba [16] is a state-space model (SSM) for efficient sequence modeling, achieving strong performance on long-sequence tasks with reduced computational and memory complexity compared to transformers, while remaining competitive across diverse learning tasks. Prior studies indicate that its effectiveness mainly stems from the forget-gate mechanism and a modified block design. However, the recurrent nature of the forget gate introduces causal constraints, making it suboptimal for non-causal vision applications. To overcome this limitation, our MGLA replaces the forget gate with parallelizable positional encoding schemes (e.g., LePE, CPE, or RoPE), preserving positional awareness while enabling fully parallel computation. Moreover, MGLA inherits Mamba’s block design by integrating depth-wise convolutions and gating mechanisms into a linear attention framework. This design facilitates efficient feature extraction and improved representation capacity. By reinterpreting the selective SSM as a specialized form of linear attention, MGLA maintains the efficiency advantages of SSMs while achieving superior performance on vision tasks. Formally, the state-space model maps an input xi ∈ R to an output yi ∈ R via a hidden state hi , and the selective SSM in Mamba can be rewritten as follows: ei ⊙ hi−1 + Bi (∆i ⊙ xi ), hi = A ei , Bi , hi−1 , hi ∈ Rd×1 . xi , ∆i ∈ R, A yi = Ci hi + D ⊙ xi ,

(2)

yi ∈ R, Ci ∈ R1×d , D ∈ R. ei is the weight matrix for the previous hidden state, where A and Bi , Ci are also the weight matrix; D denotes the Scalar skip-connection weight; ∆i denotes the timescale parameter; ⊙ denotes the Hadamard product.

Mamba can be considered as a variant of linear-attention Transformers with specialized attention dynamics and a modified block design. The linear attention formulation is given by: Si = 1 ⊙ Si−1 + Ki⊤ (1 ⊙ Vi ), (3) Qi Si yi = + 0 ⊙ xi . Qi Zi Under this formulation, MGLA exhibits a strong structural correspondence with linear attention. Building upon this framework, the MGLA block further integrates depth-wise convolutions and gating mechanisms. The overall computational complexity is Ω(MGLA) = 2N C 2 + 2N Cd + k 2 N C + 8N C 2

(4)

where the terms correspond to input/output projections, linear attention, depth-wise convolution, and MLP operations, respectively. Consequently, MGLA achieves efficient global modeling with linear complexity O(N ) and fully parallelizable computation. The MGLA module adaptively reweights feature regions based on their importance while modeling global context. The resulting attention mask dynamically modulates watermark strength across spatial locations, achieving a balanced trade-off between imperceptibility and robustness. Specifically, leveraging the global features of Fcover , the MGLA module generates an attention mask MA = EM GLA (Fcover ) to assist in producing the encoded image. This adaptive modulation allows Fen to be dynamically adjusted, reducing image distortion caused by watermark embedding and minimizing visible perturbations. The attention mask MA is then applied to reweight the fused feature representation XW . Finally, the encoded image is obtained through a global residual skip connection as Fen = Fcover + XW × MA . The encoding loss function LE aims to reduce the discrepancy between Fcover and Fen by adjusting the parameter θ. It consists of two components: the image reconstruction loss and the visual loss LE = ϵ1 M SE(Fcover , Fen ) + ϵ2 SSIM (Fcover , Fen )

(5)

where M SE() represents the mean-square error function, and SSIM () denotes the structural similarity index metric. The coefficients ϵ1 and ϵ2 represent the weighting factors for the image reconstruction loss and the visual loss, respectively. 2) Decoder for Watermark Retrieval: The noise module, denoted as N oise, introduces various types of differentiable noise during the iterative training process to improve watermarking robustness. Specifically, the noised feature map is generated as Fnoise = N oise(Fen , Ntrain ), where Ntrain denotes the trained noise. Subsequently, the decoder Dβ is applied to extract the embedded watermark from the noised features, yielding Wout = Dβ (Fnoise ). The decoder is trained to enhance watermark extraction robustness by minimizing the discrepancy between the extracted

watermark Wout and the original watermark Win , with respect to the decoder parameters β. The decoding loss LD is defined as: p (Win − Wout )2 . (6) LD = L Watermark extraction operates as the reverse process of embedding, utilizing a structure similar to the FFM to retrieve the watermark from the encoded image features. Excessive feature distortion may degrade decoding accuracy; therefore, decoder feedback is leveraged during noise-aware training to guide the encoder away from fragile feature regions. This collaborative optimization enables reliable watermark recovery without requiring access to the original image. 3) Discriminator: The discriminator plays a crucial role in ensuring the watermark embedded within the image is both inconspicuous and resilient. The discriminator, denoted as DCδ , is responsible for distinguishing between genuine (unwatermarked) image Fcover and fake (watermarked) image Fen . The discriminator loss assesses its ability to correctly distinguish between real and fake images, while the encoder loss motivates the encoder to generate watermarked images that become progressively harder for the discriminator to classify as fake. The discriminator adjusts its parameter δ to reduce the probability of incorrect classifications. The adversarial loss, LA , is defined as: LA = Ep ∼ F cover[log(1 − P (Fen ))]

(7)

where E represents the expectation function, which computes the mean value of the sampled data p over the probability distribution Fcover , and P (·) indicates the probability that Fen contains Win . Through this adversarial training loop, the discriminator compels the encoder to fine-tune the watermark embedding, making it more resistant to perceptual attacks, such as visual removal or distortions caused by compression and noise. Collectively, the encoder, discriminator, and decoder contribute to the system’s robustness and practical applicability, forming the foundation for comprehensive experimental evaluation. C. LZKSA Security Protocol We adopt the input-verification framework of LZKSA [35], which constructs public-coin Σ-protocols directly over RLWE commitments. Instead of reducing each constraint to a generic zero-knowledge circuit, LZKSA exploits algebraic relations compatible with the response form of Σ-protocols. Consequently, the same proof flow establishes both consistency with the committed input and satisfaction of L∞ -, L2 -, and cosinesimilarity constraints (Algorithm 1). Let Rq be the underlying cyclotomic ring. A client packs its input into x ∈ Rt and computes c = Com(a, s, x, e; q, t) := [as + x + te]q ,

(8)

where a ∈ Rq is public, s ∈ Rq is secret, and e is small. Under RLWE, c is computationally hiding and binding. Moreover, the ciphertext submitted for secure aggregation is directly reused as the commitment, avoiding a separate commitment layer.

Algorithm 1: LZKSA-Based Input Verification Input: x, public (a, y), bounds (B∞ , B2 ), threshold α Output: AcceptPor Reject P Client i:; s ← i<j s ∗ ij − ∗i > js ∗ ij;; c ← Com(a, s, x, e; q, t);; π ∗ key ← (ZKAgg (s), ZKCli (s, s ∗ ij ∗ j));; π ∗ ∞ ← ZK∞ (a, c; x, s, e, B ∗ ∞);; π2 ← ZK2 (a, c; x, s, e, B2 );; πcos ← ZKcos (a, c, y; x, s, e, α, B2 );; Send (c, πkey , π∞ , π2 , πcos ) to the server.; Server:; acc ← Verify(c, y, B∞ , B2 , α; πkey , π∞ , π2 , πcos );; if acc = 0 then return Reject return Accept and aggregate c;

For secure P aggregation, P client i derives its masking key as si = i<j sij − P i>j sij . The protocol ZKAgg proves global cancellation, i si = 0, while ZKCli proves the local decomposition of si and the pairwise consistency sij = sji . The latter allows an inconsistent client to be identified, which cannot be achieved from the global cancellation condition alone. We omit the client subscript below. For the L∞ constraint, the prover samples a bounded blinding element µ and, after receiving challenge γ, returns S = µ + γx. The verifier checks the corresponding ringlinear consistency equation and |S|∞ ≤ (γ + 1)B∞ . With the protocol-prescribed challenge range, acceptance implies |x|∞ ≤ B∞ : an out-of-range integral coefficient cannot be hidden by bounded µ. Thus, no independent per-coordinate range proofs are required. For |x|2 ≤ B2 , LZKSA proves the equivalent squared-norm bound. Using coefficient-wise multiplication ◦, the verifier checks |µ ◦ µ + γ(x ◦ x)|1 ≤ (γ + 1)B22 , (9) where |µ|2 ≤ B2 and γ > B22 . Because squared coefficient norms are integral, this inequality implies |x|22 ≤ B22 . RLWE commitments are not multiplicatively homomorphic; therefore, LZKSA introduces commitments to the required quadratic and cross terms, such as x ◦ x, 2x ◦ µ, and µ ◦ µ, and binds them through additional linear consistency equations. Finally, a cosine constraint against public reference y is reduced to a bounded scalar comparison. Let XY = ⟨x, y⟩2 , XX = α2 |y|22 |x|22 .

(10)

A threshold on squared cosine similarity is equivalent to proving the appropriate sign of v = XY − XX (or XX − XY for the reverse inequality). The value |x|22 is obtained from the validated x◦x using a coefficient-summing operator. Similarly, ⟨x, y⟩ is derived from x ◦ y, and its square is linked through auxiliary commitments. A dedicated RLWE range proof then establishes 0 ≤ v < 2p for a suitable p by encoding the bit decomposition of v as compressed inner-product relations.

Hence, LZKSA provides constraint-specialized proofs that are directly bound to aggregation ciphertexts. It avoids generic circuit reductions and discrete-log commitments, while preserving zero knowledge of x and reducing communication and verification costs. D. Cross-Layer Security Complementarity The Keyed PAM watermarking layer and the LZKSAbased secure aggregation layer are designed to protect distinct yet complementary components of the federated learning pipeline. They jointly address orthogonal threat vectors that commonly arise in real-world federated learning deployments. PAM watermarking mitigates risks associated with dataset leakage, data theft, and unauthorized reuse of sensitive images, while LZKSA defends against malicious gradient manipulation, poisoning at the optimization level, and aggregation-time attacks. Together, they provide a broader security coverage than either approach alone. The proposed framework establishes an end-to-end protection model that aligns with real-world FL deployment constraints and adversarial capabilities. V. E XPERIMENTAL R ESULTS In this section, we evaluate the proposed dual-layer framework at both component and system levels. While the watermarking and LZKSA secure aggregation scheme offer complementary guarantees, isolated evaluation is insufficient to demonstrate robustness under realistic adversarial settings. Accordingly, we conduct (1) component-level analysis, including watermark imperceptibility and robustness, as well as the correctness and efficiency of the LZKSA protocol. and (2) system-level evaluation under composite attack scenarios. A. Experimental Setup Implementation Details. Our framework is evaluated in a simulated FL environment. Multiple clients perform local training on private datasets and submit masked gradients; an aggregation server then runs the LZKSA protocol to perform secure aggregation (SA). The watermarking model is implemented in PyTorch on an NVIDIA Tesla V100 GPU using COCO [1], ImageNet-10 [12], and FFHQ [21] datasets, with all images resized to 512 × 512 × 3. The LZKSA verification prototype is implemented in Rust and evaluated on an Intel Core i7-9700 3.00 GHz CPU with 32 GB RAM, assuming symmetric computing power across clients and the aggregator. Evaluation Metrics. Watermark imperceptibility is quantified via PSNR and SSIM over five-fold cross-validation, while extraction robustness is measured by Bit Accuracy (BA), defined as the ratio of correctly recovered bits to the ground-truth payload. SA denotes the baseline secure aggregation process under client (Keyclient ) and aggregator (Keyagg ) authentication protocols, while ZK∞ , ZK2 , and ZKcos represent the zeroknowledge verification bounds for the L∞ -norm, L2 -norm, and cosine similarity of input updates, respectively.

TABLE I C OMPARISON OF DIFFERENT MODELS ON THE COCO DATASET. w = 30

Model

HiDDeN [50] MBRS [22] ReDMark [2] FMGAN

w = 64

PSNR

SSIM

PSNR

SSIM

32.03 33.29 37.64 41.75

0.9143 0.9022 0.9681 0.9903

31.93 33.03 37.26 41.59

0.9137 0.9025 0.9678 0.9902

B. Component-Level Evaluation 1) Evaluation of FMGAN Watermarking: We evaluate FMGAN watermarking for data-level protection using a keyed PAM payload, independent of downstream training dynamics or gradient behavior. Watermark Invisibility: Table I benchmarks FMGAN against HiDDeN [50], MBRS [22], and ReDMark [2] using binary payloads (w ∈ {30, 64}-bits) across 1,000 COCO images. The framework achieves a w-bit security level against keyless adversaries, limiting the per-trial forgery probability to 2−w and requiring O(2w ) trials. We therefore enforce w = 64 for robust security deployment, while adopting w = 30 only for baseline capacity and imperceptibility evaluations. FMGAN consistently outperforms all baselines. Specifically, it preserves optimal fidelity with an average PSNR of 41.59 dB and an SSIM of 0.9902 at w = 64. Additionally, HMACSHA256 generation incurs a negligible overhead of 0.01 ms, which does not bottleneck the embedding pipeline. Figure 5 shows subjective invisibility performance. The generated attention maps (Fig. 5b) adaptively allocate stronger watermark signals to texture-rich, visually insensitive regions (indicated in yellow). This ensures that the watermarked assets (Fig. 5c) remain perceptually indistinguishable from the original images (Fig. 5a).

(a)

(b)

(c) COCO

FFHQ

FFHQ

TABLE II ROBUSTNESS EVALUATION OF THE PROPOSED FMGAN MODEL UNDER VARIOUS ATTACKS .

ImageNet-10

ImageNet-10

Fig. 5. Watermarking performance of FMGAN. (a) Original images. (b) Attention masks. (c) Watermarked images.

Watermark Robustness: To evaluate watermark extraction resilience to typical transmission and storage distortions, we measure Bit Accuracy (BA) across five categories: noise, compression, color, filtering, and geometric attacks. As shown in Table II, FMGAN

Attack

Parameter

HiDDeN (%)

FMGAN (%) w 30

=

w 64

=

Gaussian Noise

0.001 0.05 0.10

83.14 80.36 76.55

100.00 98.19 96.37

100.00 99.39 97.95

JPEG

QF=10 QF=50 QF=90

73.69 76.72 92.05

94.46 98.55 99.21

96.79 98.04 99.32

Cropping

[20,20,420,420]

79.24

98.36

99.05

Dropout

0.3

86.87

99.15

99.34

Salt & Pepper

0.001 0.05 0.10

89.93 82.47 79.23

99.24 98.26 97.59

99.47 98.14 98.78

Rotation

45◦ 90◦

78.56 75.67

97.95 96.77

98.65 98.19

Median Filter

[2,2] [3,3]

88.22 80.74

98.80 97.41

99.03 98.37

Brightness

1.1 1.3

92.19 83.46

98.94 97.28

99.02 98.79

Contrast

1.0 2.0

84.64 77.53

97.08 96.66

97.82 97.23

Scaling

0.5 2.0

76.39 81.45

98.54 96.80

99.07 96.66

Shearing

[0.4,0.4]

80.63

98.69

99.04

Histogram Eq.

1.0

86.16

98.91

99.18

consistently outperforms HiDDeN under severe degradation vectors. Under additive Gaussian noise (σ 2 = 0.10), FMGAN maintains a high BA of 96.37%, whereas HiDDeN drops to 76.55%. Similarly, under aggressive JPEG compression (QF = 10), FMGAN’s accuracy exceeds HiDDeN’s by 20.77%. Our model also demonstrates superior robustness against both color distortions (salt-and-pepper noise, brightness/contrast adjustments, histogram equalization) and geometric attacks (cropping, scaling, rotation, shearing). Furthermore, this robust extraction performance remains highly stable when scaling the payload to 64 bits, confirming an optimized trade-off between capacity, imperceptibility, and robustness. Comparison With SOTA Watermarking Models: To further validate the effectiveness of the proposed approach, we conduct comparative experiments against several SOTA watermarking methods that incorporate noise-aware training strategies. Table III presents a comprehensive comparison of invisibility and robustness on the COCO dataset. The results demonstrate that FMGAN consistently outperforms all competing SOTA methods. In particular, FMGAN achieves superior image quality while exhibiting stronger robustness than DA, SSLW, and TSDL. Cross-dataset generalization is further examined by conducting evaluations on ImageNet-

TABLE III C OMPARISON OF DIFFERENT MODELS ON THE COCO DATASET. Invisibility

Robustness (%)

Model

PSNR SSIM JPEG Cropout Dropout Crop Gauss. (dB) (50) (30%) (30%) (3.5%) (2.0)

ReDMark [2] DA [36] TSDL [31] MBRS [22] SSLW [14] FMGAN

38.94 33.75 33.53 35.79 34.02 41.75

0.9673 0.8702 0.8931 0.8896 0.8737 0.9903

74.62 81.75 76.24 91.94 83.03 98.55

92.57 91.01 96.59 99.98 79.64 99.05

100.00 50.23 93.56 60.08 89.04 98.61 92.69 100.00 50.72 98.95 99.05 99.98

91.98 97.93 97.41 99.96 88.17 100.00

2) Evaluation of Secure Aggregation: To evaluate the performance of the proposed LZKSA protocol in FL scenarios, we conducted experiments on multiple widely used datasets with standard model architectures. Specifically, we trained a convolutional neural network in the Federated-MNIST dataset [8], employed LeNet-5 [24] and ResNet-20 convolutional neural networks in the CIFAR-10 S and CIFAR-10 L datasets [23], respectively, and trained an LSTM model [19] in the Shakespeare text-based dataset. For the ImageNet-10 dataset, we adopted ResNet-18 [18] as the backbone model. All experiments were conducted in the same FL setting that contains clients and an aggregation server.

TABLE IV C OMPARISON OF DIFFERENT MODELS ON THE I MAGE N ET-10 DATASET. Invisibility Model

Robustness (%)

PSNR SSIM JPEG Cropout Dropout Crop Gauss. (dB) (50) (30%) (30%) (3.5%) (2.0)

HiDDeN [50] 33.28 DA [36] 34.08 TSDL [31] 33.42 MBRS [22] 37.06 SSLW [14] 35.14 FMGAN 41.83

0.9105 0.8721 0.8906 0.8914 0.8829 0.9901

76.42 81.56 76.63 91.85 83.15 98.34

95.87 91.06 96.41 99.96 79.86 99.02

95.43 97.85 97.28 99.92 88.73 100.00

96.04 93.47 89.11 92.57 61.83 99.01

88.69 60.02 98.57 99.15 98.71 100.00

10, with comparisons against HiDDeN, MBRS, SSLW, and FMGAN summarized in Table IV. Watermark Removal Attack: We employed a state-of-theart watermark removal method from ICLR 2025 [32], which reduced the TPR@1%FPR metric from 1.00 to 0.02, while the Bit Accuracy also dropped significantly, from 1.00 to 0.43 on average. Although the watermark removal attack was effective in reducing the watermark detection performance, the diffusion-based image regeneration process [32] introduced perceptible visual inconsistencies. As shown in Figure 6, while the regenerated images preserved the primary object structures and overall contours with high fidelity, noticeable discrepancies in fine-grained details remained in the background regions. These artifacts can still be identified by human observers, making the regenerated images distinguishable from the original watermarked images. Therefore, we argue that current watermark removal attacks cannot yet be considered fully successful, but instead provide valuable insights for the development of more robust future defense mechanisms.

(a)

(b)

Fig. 6. Watermark Removal Attack. (a) Watermarked images. (b) Watermarkremoved images. The red dashed boxes highlight visually noticeable differences.

Fig. 7. Left: Per-client computation time comparison of the LZKSA protocols and SA. Right: Server-side computation time across different datasets. Both plots are obtained with 50 clients. A–E denote MNIST (19k), CIFAR-10 S (62k), CIFAR-10 L (273k), Shakespeare (818k), and ImageNet-10 (11181k), respectively.

Figure 7 compares the execution time of our protocol with the standard SA scheme under different data dimensions, corresponding to MNIST, CIFAR-10 S, CIFAR-10 L, Shakespeare, and ImageNet-10, where the parameter sizes range from 19k to 11181k. We report both the per-client computation time and the server-side computation time for all clients, assuming a total of 50 participating clients. On the client side, the experimental results in the left plot of Fig. 7 indicate that the additional overhead introduced by the proposed verification protocols remains negligible across all data dimensions. In particular, for small- and mediumscale datasets (19k and 62k), the computation time for Keyagg , Keyusr and data validation protocols (ZK∞ , ZK2 and ZKcos ) is consistently below 0.2 seconds, which is insignificant compared to the overall execution time of SA. Even for largescale settings such as Shakespeare (818k) and ImageNet-10 (11181k), the client-side overhead increases smoothly and remains practical, which demonstrates good scalability with respect to data dimensionality. On the server side, the computation time also grows linearly with user size, as shown in the right plot of Fig. 7, which is consistent with the theoretical complexity analysis. Among all protocols, ZKcos incurs the largest overhead, as it requires verification over all clients and involves more complex arithmetic operations. Nevertheless, even in the largest configuration (11181k), the server-side verification time remains within an acceptable range. Compared to the baseline SA protocol, the additional verification cost introduced by our method does not

TABLE V D ETECTION P ERFORMANCE UNDER DATASET R EPLACEMENT AND G RADIENT S CALING (ATTACK I)

TABLE VII D ETECTION P ERFORMANCE UNDER F ORGED DATA I NJECTION AND D IRECTIONAL G RADIENT M ANIPULATION (ATTACK II)

Dataset Replacement (10% Replaced)

Forged Data Injection (10% Injected)

Metric

Replaced Images

Number of Images 100 Detection Rate 100% FPR –

Watermarked Images

Overall

Metric

900 – 0%

1000 100% 0%

Number of Images 100 Detection Rate 100% FPR –

Gradient Scaling

Injected Images

Watermarked Images

Overall

1000 – 0%

1100 100% 0%

Directional Gradient Manipulation

Metric

B = 0.5

B = 1.0

B = 1.5

B = 5.0

Metric

α=0

α = 0.5

α = 0.8

α = 1.0

Accuracy

82%-87%

93%-94%

95%-96%

33%-34%

Accuracy

63%

91%

95%

86%

TABLE VI S YSTEM P ERFORMANCE UNDER ATTACK I No defense

FMGAN only

LZKSA only

Dual-layer framework

Unauthorized samples detected

0%

100%

0%

100%

Malicious updates accepted

100%

100%

4%-5%

4%-5%

dominate the overall aggregation process. Overall, the results in Fig. 7 demonstrate that the proposed protocol achieves efficient and scalable input verification with minimal computational overhead for both clients and the server. Similar to the observations reported in LZKSA, the experimental results confirm that the added security guarantees can be obtained without sacrificing the practicality of federated learning, even under large-scale and high-dimensional settings. C. System-Level Threat Evaluation Real-world FL systems face composite adversarial behaviors that simultaneously target multiple layers. We conduct a system-level threat evaluation under realistic cross-layer attack scenarios. We consider three representative composite attacks that jointly exploit data manipulation, gradient tampering, and cryptographic protocol abuse. 1) Attack I: Dataset Replacement and Gradient Scaling Attack: We assume that a malicious adversary compromises a client and gains full control over its local training process and gradient transmission. The adversary replaces the local training dataset with unauthorized or irrelevant data assets and simultaneously substitutes the uploaded gradient with an abnormally large-magnitude vector to disrupt aggregation (input-out-of-range attack). To detect dataset substitution, we simulate a 10% random replacement across 1,000 watermarked COCO images. As Table V shows, our verification pipeline detects all substituted assets with 100% accuracy and zero false positives. Concurrently, gradient scaling attacks are mitigated by validating update norms against L∞ and L2 verification bounds (ZK∞ , ZK2 ). Because bounding thresholds dictate the falsepositive/false-negative trade-off, we evaluate median-derived

scaling limits B ∈ {0.5, 1.0, 1.5, 5.0} (Table V). Our results indicate that B = 1.5 yields an optimal security-utility tradeoff, aligning with the empirical results of ROFL [37]. Finally, Table VI presents the system security performance under this joint threat model. The results confirm that our integrated FMGAN + LZKSA framework robustly mitigates these concurrent cross-layer attacks, significantly outperforming both standalone defenses and undefended baselines. 2) Attack II: Forged Data Injection and Directional Gradient Manipulation: We assume that a malicious adversary compromises a client and gains control over its local training process and gradient transmission. The adversary injects poisoned or forged samples (e.g., backdoor triggers) into the local dataset, and simultaneously performs directional manipulation of gradients, such as sign-flipping or targeted direction amplification, to strengthen the poisoning effect during aggregation. To detect forged data injection, we introduce 10% unwatermarked images into a dataset of 1,000 watermarked COCO assets. As shown in Table VII, the proposed mechanism achieves a 100% detection rate with zero false positives on genuine images. Additionally, gradient directional anomalies are constrained using cosine similarity: cos(x, y) < α, where x is the input gradient, y is the median benchmark, and α represents the threshold. While setting α → 1 tightens security with the lower possibility of non-compliant data entering, but it at the expense of higher false-rejection rates. The empirical evaluation identifies α = 0.8 as the optimal threshold for balancing update utility and anomaly filtering (Table VII). 3) Attack III: Data Noise Perturbation and Secure Aggregation Protocol Abuse: We assume a compromised client that targets both watermark reliability and aggregation integrity. To degrade the detectability of watermarks, an adversary perturbs local training assets with adversarial noise. At the model level, it attempts to subvert the secure aggregation protocol by: 1) submitting malformed encrypted gradients, 2) executing partial aggregation replay attacks, or 3) generating structurally valid but mathematically incorrect zero-knowledge proofs. Such aggregation-targeted attacks will be directly rejected by the server (Algorithm 1) because they would result in a mismatch between the left and right sides of the corresponding verification equation. The probability of successfully passing

HiDDeN HiDDeN-NN

90 80 70 60 0

20

40

P

60

HiDDeN HiDDeN-NN

100 Bit Accuracy (%)

Bit Accuracy (%)

100

110

FMGAN FMGAN-NN

80

80 70

60 50

20

40

70

80

100

0.0

0.5

1.0

1.5

50 1.2

1.4

HiDDeN HiDDeN-NN

100

2.5

3.0

3.5

4.0

3.5

4.0

FMGAN FMGAN-NN

90

70

50 1.0 R

FMGAN FMGAN-NN

80

60

2.0

(c)

90

60

(d)

60

Bit Accuracy (%)

80

0.8

P

HiDDeN HiDDeN-NN

100 Bit Accuracy (%)

Bit Accuracy (%)

110

FMGAN FMGAN-NN

90

0.6

70

(b)

HiDDeN HiDDeN-NN

100

80

50 0

FMGAN FMGAN-NN

90

60 100

HiDDeN HiDDeN-NN

100

90

(a) 110

110

FMGAN FMGAN-NN

Bit Accuracy (%)

110

80 70 60 50

50

60

70

Q

80

90

100

40 0.0

0.5

1.0

(e)

1.5

2.0

2.5

3.0

(f)

Fig. 8. Robustness evaluation under multiple intensity levels of trained noises. (a) Crop, (b) Dropout, (c) Gaussian blur, (d) Resize, (e) JPEG compression, (f) JPEG (Q=50) + Gaussian blur.

verification under such attacks is negligible in the security parameter under the RLWE assumption. We evaluate Attack III’s impact on watermark detectability (Fig. 8) across FMGAN, HiDDeN, and their "NN" (no-noisesubnetwork) variants. The evaluation spans varying distortion parameters: crop/dropout probability P , JPEG quality factor Q, resizing ratio R, and Gaussian blur variance δ. Overall, FMGAN consistently achieves the highest BA across all perturbation types and intensities, showing strong resistance to adversarial watermark suppression. This robustness advantage is particularly pronounced under representative degradation operations—namely Gaussian blur, image resizing, and JPEG compression—which are commonly exploited in practice to obscure embedded signals. Under cropping and dropout attacks (Figs. 8a,b), FMGAN and FMGAN-NN consistently outperform their HiDDeN counterparts, highlighting superior resilience against content removal. Notably, FMGAN-NN’s margin over HiDDeN-NN suggests that our feature fusion mechanism preserves intrinsic structural robustness even without noise-aware training. For Gaussian blur (Fig. 8c), FMGAN maintains high BA against low-pass filtering effects where baselines (particularly HiDDeN-NN) degrade rapidly; a similar robust trend holds for spatial resizing (Fig. 8d). Under JPEG compression (Fig. 8e), FMGAN exhibits strong resilience to aggressive quantization artifacts at low quality factors. Finally, under severe compound degradation (JPEG Q = 50 and Gaussian blur; Fig. 8f), FMGAN consistently achieves peak BA, verifying its robust extraction performance under realistic conditions. The significantly higher BA values achieved by HiDDeN

TABLE VIII U TILITY IMPACT OF THE PROPOSED SCHEME ON THE ORIGINAL FL TASK . T HE WATERMARK COLUMN REPORTS TEST ACCURACY WHEN CLIENTS TRAIN ON WATERMARKED IMAGES ; THE REMAINING COLUMNS REPORT ACCURACY AFTER ENABLING EACH PRIVATE VALIDATION COMPONENT.

Dataset

Proposed scheme

Orig. FL WM

MNIST-0.5 CIFAR-10

96.3% 83.8%

ZK2

ZK∞

ZKcos

Full

96.1% 96.2% 96.2% 96.1% 96.1% 83.6% 83.7% 83.6% 83.5% 83.4%

and FMGAN compared to their NN counterparts confirm that incorporating a noise subnetwork is critical for enhancing robustness against adversarial distortions. Moreover, the superior performance of FMGAN-NN over HiDDeN-NN further demonstrates that the proposed feature fusion mechanism contributes to stable watermark extraction even in the absence of explicit noise-aware training. 4) Utility Impact on the Original FL Task: We verify that the proposed scheme does not degrade the utility of the original FL task. By comparing the global model accuracy when clients are trained on clean and watermarked images (Table VIII), we observe that the watermarked setting achieves an accuracy of 83.6%, only 0.2 percentage points lower than the clean baseline of 83.8%. These results confirm that the high-fidelity FMGAN embedding preserves downstream training performance. Valid client updates are still aggregated under the same training objective, while the additional constraints only filter updates that violate the public validation parameters. Hence,

under benign training, the gap between Original FL (the baseline without private validation) and the Full scheme in Table VIII stems mainly from fixed-point representation and the exclusion of updates that fail these parameters. The full scheme changes the accuracy by only 0.2 percentage points on MNIST-0.5 and 0.4 percentage points on CIFAR-10, confirming its small impact on the original learning task. The scheme also preserves the robustness benefit of the validation rules under attack: on CIFAR-10 under a Trim attack, accuracy collapses from 83.8% to 19.5% without validation, but recovers to 80.1% once ZK2 , ZK∞ , and ZKcos are enabled. Thus the scheme incurs only a small benign-case cost while retaining norm- and direction-based robustness. In practice, ZK2 and ZK∞ suffice when only magnitude control is needed to limit update amplification and model replacement, while ZKcos adds directional consistency against the public cosine-similarity threshold. D. Experimental Discussions and Limitations Experimental results validate our dual-layer framework at both component and system levels. At the data layer, the keyed PAM watermarking mechanism ensures strong imperceptibility and robustness with negligible overhead, leveraging HMAC-SHA256 to align authenticity with Kerckhoffs’ principle. At the computation layer, LZKSA secure aggregation enforces gradient-level integrity; its zero-knowledge proofs (validating keys, norm bounds, and cosine similarity) successfully filter out malicious scaling and directional updates while preserving privacy and scaling linearly with client size. Finally, system-level evaluations confirm that this joint pipeline robustly mitigates composite cross-layer threats—including concurrent dataset replacement, forged data injection, noise perturbations, and protocol abuse—without sacrificing aggregation accuracy or watermark extractability. Consistent with the generation-unforgeability scope claimed above, two properties remain for future work: an indirect physical anchor coupling dependency and vulnerability to watermark-forgery (replay) attacks. First, the current watermarking mechanism relies on PAM as an indirect reference (a "soft link") to the ground-truth anchor fabric rather than embedding the real-time ENF signal directly into the host images (a "hard link"), which introduces an abstract dependency layer between the media and its environmental anchor. Second, while PAM provides broad context-binding for image datasets, it lacks intrinsic content-binding capabilities and cannot independently prevent watermark forgery; an adversary could potentially extract valid watermarks from leaked assets and maliciously transplant them onto unauthorized images, creating severe attribution vulnerabilities. To mitigate these constraints, our future research will focus on developing a unified provenance token structure that fuses context-binding metadata (such as direct ENF signals or alternative environmental anchors) with content-binding data (such as image perceptual hashes or semantic features) to support completely self-contained, cryptographic verification.

Additionally, the current watermark robustness evaluation primarily focuses on common image distortions and noisebased perturbations. Although these represent realistic degradation scenarios, more adaptive and optimization-based removal attacks could be explored to further stress-test watermark resilience. Moreover, our evaluation focuses on imagebased federated learning scenarios. Extending the keyed watermarking mechanism to other data modalities, such as text, audio, or multimodal settings, remains an important direction for future research. VI. C ONCLUSION AND F UTURE W ORK This paper presented a dual-layer security framework for trustworthy federated learning. At the data layer, we designed a Kerckhoffs-compliant keyed PAM watermarking scheme leveraging FMGAN with Mamba-guided attention to achieve robust, imperceptible ownership validation and leakage tracing. At the computation layer, we integrated a lattice-based zero-knowledge secure aggregation protocol over RLWE commitments, enforcing gradient-level key correctness, norm bounds, and directional constraints under post-quantum security. Comprehensive system evaluations confirm that this joint pipeline robustly mitigates cross-layer threats, including dataset substitution, forged data injection, gradient scaling, and protocol abuse. Future work will focus on studying adaptive watermark removal attacks, such as optimization- or learning-based strategies, to further strengthen resilience under fully adaptive threat models. Additionally, we plan to extend the keyed physical anchor watermarking scheme to other modalities (e.g., text, audio, or multimodal data) is another important direction. Furthermore, optimizing zero-knowledge verification for extremely large-scale federated deployments may further improve latency efficiency. R EFERENCES [1] “COCO,” [Online]. Available: https://cocodataset.org/#download/, 2018. [2] M. Ahmadi, A. Norouzi, N. Karimi, S. Samavi, and A. Emami, “Redmark: Framework for residual diffusion watermarking based on deep networks,” Expert Systems with Applications, vol. 146, p. 113157, 2020. [3] J. Bell, A. Gascón, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “{ACORN}: input validation for secure aggregation,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 4805– 4822. [4] J. H. Bell, K. A. Bonawitz, A. Gascón, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly) logarithmic overhead,” in Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, pp. 1253–1269. [5] E. Ben-Sasson, A. Chiesa, E. Tromer, and M. Virza, “Succinct {NonInteractive} zero knowledge for a von neumann architecture,” in 23rd USENIX Security Symposium (USENIX Security 14), 2014, pp. 781–796. [6] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS ’17). ACM, 2017, pp. 1175–1191. [7] B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell, “Bulletproofs: Short proofs for confidential transactions and more,” in 2018 IEEE symposium on security and privacy (SP). IEEE, 2018, pp. 315–334. [8] S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Konečnỳ, H. B. McMahan, V. Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” arXiv preprint arXiv:1812.01097, 2018.

[9] P. Chatterjee, D. Das, and D. B. Rawat, “Federated learning empowered recommendation model for financial consumer services,” IEEE Transactions on Consumer Electronics, vol. 70, no. 1, pp. 2508–2516, 2023. [10] X. Chen, J. Deng, Y. Chen, C. Li, X. Fang, C. Liu, and W. Xu, “Imprints: Mitigating watermark removal attacks with defensive watermarks,” IEEE Transactions on Information Forensics and Security, 2025. [11] A. Cooper, C. Grigoras et al., “Forensic authentication of digital video recordings using the electric network frequency signal,” in Proceedings of the AES 39th International Conference, 2010. [12] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, pp. 248–255. [13] T. Eltaras, F. Sabry, W. Labda, K. Alzoubi, and Q. Ahmedeltaras, “Efficient verifiable protocol for privacy-preserving aggregation in federated learning,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 2977–2990, 2023. [14] P. Fernandez, A. Sablayrolles, T. Furon, H. Jégou, and M. Douze, “Watermarking images in self-supervised latent spaces,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022, pp. 3054–3058. [15] C. Grigoras, “Digital audio recording analysis: The electric network frequency criterion,” International Journal of Speech Language and the Law, vol. 12, no. 1, pp. 63–76, 2005. [16] A. Gu and T. Dao, “Mamba: Linear-time sequence modeling with selective state spaces,” in First conference on language modeling, 2024. [17] M. Hamidi, M. El Haziti, H. Cherifi, and M. El Hassouni, “A hybrid robust image watermarking method based on dwt-dct and sift for copyright protection,” Journal of Imaging, vol. 7, no. 10, p. 218, 2021. [18] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778. [19] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural computation, vol. 9, no. 8, pp. 1735–1780, 1997. [20] J. Huang, T. Luo, L. Li, G. Yang, H. Xu, and C.-C. Chang, “Arwgan: Attention-guided robust image watermarking model based on gan,” IEEE Transactions on Instrumentation and Measurement, vol. 72, pp. 1–17, 2023. [21] jannehellsten, “FFHQ,” [Online]. Available: https://github.com/NVlabs/ffhq-dataset?tab=readme-ov-file/, 2020. [22] Z. Jia, H. Fang, and W. Zhang, “Mbrs: Enhancing robustness of dnnbased watermarking by mini-batch of real and simulated jpeg compression,” in Proceedings of the 29th ACM international conference on multimedia, 2021, pp. 41–49. [23] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009. [24] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 2002. [25] I. Lederer, R. Mayer, and A. Rauber, “Identifying appropriate intellectual property protection mechanisms for machine learning models: A systematization of watermarking, fingerprinting, model access, and attacks,” IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 10, pp. 13 082–13 100, 2023. [26] X. Li, M. Jiang, X. Zhang, M. Kamp, and Q. Dou, “Fedbn: Federated learning on non-iid features via local batch normalization,” arXiv preprint arXiv:2102.07623, 2021. [27] Y. Li, X. Tao, X. Zhang, J. Liu, and J. Xu, “Privacy-preserved federated learning for autonomous driving,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 7, pp. 8423–8434, 2021. [28] X. Liu and R. Xu, “From vulnerability to robustness: A survey of patch attacks and defenses in computer vision,” Electronics, vol. 14, no. 23, p. 4553, 2025. [29] X. Liu, R. Xu, and Y. Chen, “A decentralized digital watermarking framework for secure and auditable video data in smart vehicular networks,” Future Internet, vol. 16, no. 11, 2024. [30] X. Liu, R. Xu, and X. Peng, “Bewsat: blockchain-enabled watermarking for secure authentication and tamper localization in industrial visual inspection,” in Eighth International Conference on Machine Vision and Applications (ICMVA 2025), vol. 13734. SPIE, 2025, pp. 54–65. [31] Y. Liu, M. Guo, J. Zhang, Y. Zhu, and X. Xie, “A novel two-stage separable deep learning framework for practical blind watermarking,” in Proceedings of the 27th ACM International conference on multimedia, 2019, pp. 1509–1517.

[32] Y. Liu, Y. Song, H. Ci, Y. Zhang, H. Wang, M. Z. Shou, and Y. Bu, “Image watermarks are removable using controllable regeneration from clean noise,” in International Conference on Learning Representations, vol. 2025, 2025, pp. 87 310–87 327. [33] Liu, Xinyun and Xu, Ronghua and Chen, Yu, “Anchormark: Realworld anchor-based watermarking for digital content authentication and manipulation detection,” in 16th EAI International Conference on Digital Forensics & Cyber Crime (ICDF2C). Springer, 2025, pp. 1–16. [34] Liu, Xinyun and Xu, Ronghua and Chen, Yu, “Securing digital media integrity: A survey of watermarking and manipulation detection for image authentication,” Authorea Preprints, 2025. [35] Z. Lu and S. Lu, “Lzksa: Lattice-based special zero-knowledge proofs for secure aggregation’s input verification,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 573–587. [36] X. Luo, R. Zhan, H. Chang, F. Yang, and P. Milanfar, “Distortion agnostic deep watermarking,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 13 548–13 557. [37] H. Lycklama, L. Burkhalter, A. Viand, N. Küchler, and A. Hithnawi, “Rofl: Robustness of secure federated learning,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 453–476. [38] Y. Ma, J. Wang, J. Yang, and L. Wang, “Model-heterogeneous semisupervised federated learning for medical image segmentation,” IEEE Transactions on Medical Imaging, vol. 43, no. 5, pp. 1804–1815, 2024. [39] D. Nagothu, Lightweight Multimedia Authentication at the Edge Using Environmental Fingerprint. State University of New York at Binghamton, 2023. [40] D. Nagothu, R. Xu, and Y. Chen, “Dema: decentralized electrical network frequency map for social media authentication,” in Disruptive Technologies in Information Sciences VII, vol. 12542. SPIE, 2023, pp. 57–72. [41] National Institute of Standards and Technology, “Fips 203: Module-lattice-based key-encapsulation mechanism standard (final),” U.S. Department of Commerce, NIST, Aug. 2024, available online: https://csrc.nist.gov/pubs/fips/203/final. [Online]. Available: https://csrc.nist.gov/pubs/fips/203/final [42] National Institute of Standards and Technology, “Fips 204: Module-lattice-based digital signature standard (final),” U.S. Department of Commerce, NIST, Aug. 2024, available online: https://csrc.nist.gov/pubs/fips/204/final. [Online]. Available: https://csrc.nist.gov/pubs/fips/204/final [43] L. Rosenthol, “C2pa: the world’s first industry standard for content provenance (conference presentation),” in Applications of Digital Image Processing XLV, vol. 12226. SPIE, 2022, p. 122260P. [44] J. So, C. He, C.-S. Yang, S. Li, Q. Yu, R. E. Ali, B. Guler, and S. Avestimehr, “Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning,” in Proceedings of Machine Learning and Systems (MLSys), vol. 4, 2022, pp. 694–720, also available as arXiv:2109.14236. [45] W. Wan, J. Wang, Y. Zhang, J. Li, H. Yu, and J. Sun, “A comprehensive survey on robust image watermarking,” Neurocomputing, vol. 488, pp. 226–247, 2022. [46] X. Wu, X. Liao, and B. Ou, “Sepmark: Deep separable watermarking for unified source tracing and deepfake detection,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 1190–1201. [47] R. Xu, X. Liu, D. Nagothu, Q. Qu, and Y. Chen, “Detecting manipulated digital entities through real-world anchors,” in International Conference on Advanced Information Networking and Applications. Springer, 2025, pp. 450–461. [48] Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, “Gaussian shading: Provable performance-lossless image watermarking for diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 162–12 171. [49] X. Zhang, R. Li, J. Yu, Y. Xu, W. Li, and J. Zhang, “Editguard: Versatile image watermarking for tamper localization and copyright protection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 11 964–11 974. [50] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “Hidden: Hiding data with deep networks,” in Proceedings of the European conference on computer vision (ECCV), 2018, pp. 657–672. [51] L. Zhu, X. Tang, M. Shen, F. Gao, J. Zhang, and X. Du, “Privacypreserving machine learning training in iot aggregation scenarios,” IEEE Internet of Things Journal, vol. 8, no. 15, pp. 12 106–12 118, 2021.

Related documents

• Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning#659143
• Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning#657007
• SecureTrust-FL: trust-aware privacy-preserving federated learning for network intrusion detection.#685916
• Dual watermark authentication defense for federated learning: lossless integrity verification against model poisoning#324014
• Verifiable Secure Aggregation via Dual Servers with Linear Tags in Federated Learning#665777