零知识证明准入机制让 Swarm Learning 兼顾隐私与鲁棒性
Robust and Private Swarm Learning via Zero-Knowledge Validator Admission and Consensus Aggregation
联邦学习最常见的死法是被恶意客户端投毒，这篇论文用零知识证明把验证者准入做成了可审计的，攻击下 FedAvg 掉到 2% 它还有 94%。做去中心化训练或隐私敏感场景的工程师应该看看这套共识加审计的设计。
一篇 arXiv 论文提出一个带可验证数据质量准入的 Swarm Learning 框架：节点必须先通过零知识证明证明参考模型在其私有数据上正确运行，才能成为验证者，全程不暴露原始样本。
框架利用证明产生的无标签类别画像组建集体近似 IID 的验证者池，与真标签 oracle 的总变差距离为 0.025，仅略差于 oracle 的 0.
021，而随机选择为 0.21。
验证者通过 Tendermint 式 BFT 共识就梯度掩码和质量加权达成一致，并借鉴 Split Learning 的 cut-layer 思路设计挑战式审计，避免端到端零知识证明的高开销。在四个基准的非 IID 划分下，干净数据表现与 FedAvg 持平；
在梯度缩放攻击下，CIFAR-100 保留 94% 干净准确率、FashionMNIST 超过 99%，而 FedAvg 仅剩 2.1% 和 11%。
Robust and Private Swarm Learning via Zero-Knowledge Validator Admission and Consensus Aggregation
Swarm Learning improves resilience and removes the need for a single trusted coordinator by distributing model aggregation and validation across participating nodes. However, it also delegates the validation of model updates to peers whose private data may be biased, unrepresentative, or adversarial, and existing Swarm Learning protocols generally do not attest that data, leaving decentralized validation as an attack surface. We present a robust, privacy-preserving Swarm Learning framework that makes verifiable data quality the condition for admission to the learning task. A validator joins only after a zero-knowledge attestation proves, without revealing any raw sample, that a reference model ran correctly on its private data. The attested outputs also yield a label-free class profile, so the network assembles a collectively IID validator pool from individually skewed validators as accurately as an oracle with the true labels (total-variation distance to uniform 0.025, against 0.021 for the oracle and 0.21 for random selection). Admitted validators score client updates and, through a Tendermint-style Byzantine Fault Tolerant consensus, agree on a gradient mask and a quality-derived aggregation weight for each submission, replacing dataset-size weighting with a quality-aware signal. Adapting the cut-layer idea of Split Learning, a challenge-based audit lets peers re-verify that a mask was computed on the attested data without an expensive end-to-end zero-knowledge proof. Across four benchmarks under non-IID partitions the framework matches FedAvg on clean data; under a gradient-scaling attack that collapses FedAvg to random chance, it retains 94% of clean accuracy on CIFAR-100 and over 99% on FashionMNIST, where FedAvg achieves only 2.1% and 11%. The result is a private, robust, and auditable foundation for decentralized learning.
This report is categorized under AITOP's "Papers" desk. Key entities and technical topics under continuous tracking include Swarm Learning, 零知识证明, FedAvg, 联邦学习.
Source attribution: curated from arXiv cs.LG (@Marco Arazzi, Mert Cihangiroglu, Antonino Nocera).