With the widespread adoption of cloud computing technologies [1], the migration of large amounts of user data to the cloud has become an irreversible trend. To address the risks of privacy breaches, encrypting data for storage has become essential. However, this measure introduces new challenges, particularly in performing operations such as metadata embedding and identity authentication while ensuring data confidentiality.

To address these challenges, the technique of reversible data hiding in the encrypted domain (RDHED) [2–4] has emerged as a promising solution. This technology enables the reversible embedding of data, such as identity markers and integrity labels, within encrypted data [5,6]. Upon decryption, both the original data and the embedded data can be completely recovered, providing an innovative approach to managing encrypted data. Despite significant advancements in traditional RDHED methods, most existing schemes rely on stream cipher encryption mechanisms, which do not support ciphertext operations [2,4–6]. This limitation makes them unsuitable for emerging privacy-preserving computing scenarios, such as federated learning (FL) [7].

In recent years, homomorphic encryption (HE)-based RDHED schemes have gained attention as a potential solution [8–10]. However, these approaches face two major technical challenges. First, their applicability is often limited because most existing research focuses on image data processing, while FL predominantly involves model parameters. Second, compatibility issues arise: existing methods do not adequately address the destructive effects of homomorphic processing on embedded data [11]. For instance, when encrypted data undergo homomorphic processing, such as ciphertext aggregation, embedded data may suffer irreversible distortion, resulting in extraction failures [12–14]. Furthermore, FL usually involves multiple participants, yet enabling each user to independently perform data embedding and extraction independently in decentralized scenarios remains a great challenge.

In a typical FL architecture, users upload their local models to the server, which aggregates the received local models to generate the global model and distributes it back to users. However, this collaborative training mechanism raises concerns about privacy leakage. In particular, a semi-honest server can infer user privacy by analyzing local or global gradients [15–17], while a malicious server could manipulate the aggregation results, thereby compromising the usability of the global model [18]. Existing privacy protection solutions, such as HE [19,20], differential privacy [21,22], and secure multiparty computation [23], can mitigate some privacy risks. However, they fail to address a critical issue: verifying the correctness of model aggregation.

To address these challenges, several verifiable federated learning (VFL) schemes have been successively proposed [18,24–27]. These solutions primarily utilize linear homomorphic hash (LHH) [18,24–26] or dual-aggregation techniques [27] to achieve verifiability. However, they exhibit limitations: the former incurs computational overhead that scales with the model dimension, while the latter suffers from the inflation of communication costs and requires auxiliary protocols for full verifiability [28,29].

This study addresses existing challenges by focusing on two core issues: (1) designing a RDHED scheme compatible with homomorphic processing, and (2) integrating this RDHED scheme with cryptographic tools to develop an efficient verifiable privacy-preserving aggregation protocol under a single-server architecture.

To achieve these goals, we propose a joint embedding-extraction mechanism (JEEM). Using the additive homomorphic property of the Paillier encryption algorithm [19], JEEM enables multiple users to collaboratively embed and extract secret messages without altering the original plaintext. Building on JEEM, we further integrate LHH [30] and digital signatures to design a verifiable privacy-preserving aggregation protocol based on a single server (VPAFL).

The contributions of this study can be summarized as follows:

1) RDHED Scheme for Joint Secret Message Embedding and Extraction: This study resolves the compatibility limitations of existing RDHED schemes with homomorphic processing. Each user independently exploits ciphertext redundancy during encryption to embed secret messages. After the server aggregates the ciphertexts, homomorphic properties enable the fusion of all user-embedded messages within the ciphertext space, yielding a joint embedded message. Users can then extract this joint embedded message after decrypting the aggregation result.

2) Efficient Verifiable Aggregation Protocol: Compared to existing LHH-based VFL schemes, VPAFL enhances efficiency by integrating the proposed RDHED scheme. Specifically, VPAFL utilizes the secret message embedded by the users in each communication round as input for the hash value computation. This design decouples hash generation computational overhead from the model dimension, thereby significantly reducing the computational overhead of users for verification. Furthermore, VPAFL maintains minimal communication overhead of users for verification (below 0.2 KB) and achieves verification of aggregation results within only two interaction rounds under a single-server framework, significantly enhancing practical deployability.

The rest of this article is organized as follows: Section 2 reviews related works, while Section 3 introduces preliminary concepts. Section 4 provides an overview of the system and the threat Section 5 presents the proposed RDHED scheme and details the VPAFL protocol. Sections 6 and 7 offer theoretical analyses and experimental results, respectively. Finally, Section 8 concludes this study.

With the widespread application of HE in privacy computing, HE-based RDHED methods have emerged as a research hotspot [12]. These schemes are categorized into two types based on their impact on plaintext: plaintext modification schemes (Type I) and lossless data hiding schemes (Type II). Specifically, Type I methods involve embedding operations that result in changes to plaintext [9,10,13,14]. For example, a typical method modifies the ciphertext value c to produce a decrypted plaintext of the form 2m+b, where m is the original plaintext, and b∈{0,1} denotes the embedded 1 bit message. During data extraction, the embedded bit b is extracted by computing (2m+b)mod2, while m is recovered by integer division ⌊(2m+b)/2⌋. However, a critical limitation of Type I schemes is that they are not well suited for directly processing ciphertexts containing embedded messages. As a result, employing Type I methods may limit the processing of ciphertexts.

In contrast, Type II schemes aim to achieve lossless data hiding in ciphertexts (LDH-CT) without altering plaintexts or increasing ciphertext size [8,11,12]. For example, Zheng et al. [12] proposed a LDH-CT scheme based on numerical interval mapping: the data hider modifies the ciphertext to fall into specific subintervals corresponding to embedded bits. Using the homomorphic and probabilistic properties of cryptosystems to ensure invariance of plaintext. Wu et al. [11] proposed a RDHED scheme using random number substitution (RS). In this scheme, binary secret messages are first converted into decimal numbers that then replace the random numbers used during the encryption process to embed the data. However, this method constrains the bit length of embedded messages, as exceeding predefined limits disrupts both encryption and decryption processes.

Despite advances in existing research, two critical challenges hinder the application of RDHED schemes to FL: First, existing RDHED schemes primarily target image data carriers, whereas FL predominantly processes model parameters. Second, existing schemes do not adequately address compatibility with homomorphic processing [12–14]. In particular, when encrypted data containing embedded information undergoes homomorphic computations, such as ciphertext aggregation, the embedded data may suffer irreversible distortion, thereby leading to extraction failure.

In FL, the trustworthiness of the servers cannot be absolutely guaranteed as malicious servers can return incorrect aggregation results [18,24,25]. Models derived from such compromised servers inevitably underperform in prediction or classification tasks, necessitating VFL schemes to mitigate these risks.

Existing VFL research follows mainly two technical paths: LHH-based schemes [18,24–26] and dual-aggregation frameworks [27]. Xu et al. [18] proposed the first VFL framework, integrating a double-masking protocol [23] for privacy protection with LHH and pseudorandom techniques to achieve verifiable aggregation. However, this scheme suffers from two critical drawbacks: First, communication overheads scale with the model dimension. Second, computationally intensive bilinear pairing operations. To optimize communication efficiency, Guo et al. [24] proposed VeriFL, which decouples communication overhead for verification from model dimensions via LHH combined with equivocal commitments. Recent advances include VPFLI [25] and PriVeriFL [26], where VPFLI [25] designs a novel aggregation protocol to minimize performance degradation caused by heterogeneous client data quality, while PriVeriFL [26] employs a blockwise encryption strategy to alleviate computational bottlenecks of HE, reducing resource demands without compromising security.

However, LHH-based VFL schemes remain plagued by high computational overhead, as the complexity of hash value calculation increases with model dimensions [26]. To enable lightweight verification, Hahn et al. proposed VERSA [27], a dual-aggregation verification framework that eliminates the need for trusted setups and uses a lightweight pseudorandom generator (PRG) to enable efficient verification of the aggregation result. However, recent studies have identified vulnerabilities that compromise its verifiability [28,29].

In summary, neither LHH-based VFL nor dual-aggregate verification-based schemes achieve high efficiency. As shown in Table 2 (detailed in Section 7.4.1), the LHH-based approach incurs significant computational overhead during verification as the model dimension grows, requiring approximately 12,490 s to compute the LHH values for models with dimensions reaching 10,000,000. In contrast, dual-aggregate verification-based schemes face substantial communication overhead: Users must submit both local model updates and validation codes derived from these parameters, which doubles their communication expenditure. Furthermore, as the model dimensionality increases, the communication overhead introduced by validation becomes impractical for real-world applications. Crucially, given the resource constraints of end-user devices, the designed VFL framework should maintain lightweight communication and computational overheads for verification to facilitate practical deployment.

Deep learning has attracted significant attention for its remarkable achievements in various fields, though high-performance deep neural networks (DNNs) typically rely on extensive datasets. However, the data used to train DNNs often contain sensitive information. For example, location-based services [31] could expose personal whereabouts, while goods purchase records can be exploited for targeted advertising. More critically, the leakage of health information or facial data poses serious privacy risks. To address these challenges, FL has emerged as a promising solution [7]. Since its inception, FL has been widely adopted in various applications such as the Internet of Things (IoT), smart healthcare [32], and smart cities [33]. FL is a distributed machine learning paradigm that collaboratively trains a global model by coordinating multiple participants without compromising data privacy. In this architecture, the server does not directly access user data; instead, it iteratively aggregates parameters to optimize the global model. Let U denote the set of participating users, where |U|=n represents the total number of users, and each user ui∈U has a private dataset Di. The FL training process proceeds iteratively through the following stages per communication round:

a) Global Model Distribution: The server broadcasts the current global model Mk to all users, where k denotes the current communication round.

b) Local Model Training: Each user ui initializes their local model with Mk and trains on Di using the stochastic gradient descent (SGD) algorithm [34].

c) Model Aggregation: The server aggregates the received local models via the Federated Averaging (FedAvg) algorithm [7] to generate the updated global model Mk+1.

Formally, during the k-th communication round, each user ui updates its local model parameters using the SGD algorithm [34]: (1)wik=wik−1−lr∇ℒ(wik−1;Di),where lr denotes the local learning rate, wik denotes the parameters of the local model for user ui during the k-th communication round, and ℒ(⋅) denotes the loss function. Subsequently, the server aggregates the received local models using the FedAvg algorithm [7] as follows: (2)wk=∑ui∈U|Di||∑ui∈UDi|wik.

LHH [30] is a one-way and collision-resistant homomorphic hash function that can calculate the hash of a composite data block based on the hash of a single data block. The LHH scheme is formally defined by three algorithms LHH = (LHH.Gen, LHH.Hash, LHH.Eval):

a) LHH.Gen(κ,v): Given the security parameters κ and a d-dimensional vector v={vi,…,vd}, this algorithm outputs public parameters pp={G,q,{g1,…,gd}}, where G is a cyclic group of prime order q, g is a generator of G, and g1,…,gd are distinct elements in G.

b) LHH.Hash(pp,v): For a d-dimensional vector v, this algorithm computes its LHH value of v: hv←∏i=1dgivi∈G.

c) LHH.Eval(pp,h1,…,hl,α1,…,αl): Given l hash values h1,…,hl and l coefficients α1,…,αl∈Zq, this algorithm outputs the linear combination of the l hash values: h←∏i=1lhlαl.

As illustrated in Fig. 1, the system model of the VPAFL protocol comprises three entities, consistent with previous works [18,24]: The trusted authority (TA), the server, and the users.

TA: The TA initializes the system by generating cryptographic parameters (public/private keys) and distributing the initial global model to all participants. It is considered trustworthy and remains offline after initialization.

Our threat model is defined as follows:

Semi-honest users: Users follow the FL protocol faithfully, but may attempt to infer sensitive information from the data of honest users. Additionally, a subset of users may collude with the server to manipulate the aggregation results.

Extending the drop-tolerant secure aggregation algorithm (DTSA) proposed by Zhao et al. [20], we propose a novel secure aggregation-data hiding (SADH) hybrid algorithm that is compatible with homomorphic processing. The core innovation of SADH lies in its JEEM, which enables users to collaboratively embed secret messages in ciphertext and extract them after aggregation. For simplicity, we assume that no user dropout occurs during training. The scheme operates as follows:

SADH.Gen(κ,t,U): This algorithm initializes cryptographic parameters. The inputs include the security parameter κ, the threshold t for the SS protocol [35] and the user set U with |U|=n. First, generate the public key PP={n,g,h,N} shared among all users, along with the private key {SK,SKi} assigned to each user ui, and the public parameter N2 for the server. In particular, two large prime numbers p,q are selected such that |p|=|q|=κ. Then, compute N=p×q and λ=lcm(p−1,q−1), where lcm(a,b) denotes the least common multiple of a and b. Next, choose a random integer g∈ZN2∗ that satisfies gcd(L(gλmodN2),N)=1, where L(x)=x−1/N. Subsequently, compute e=gσmodN2, where σ is a large prime satisfying |σ|≤κ. Finally, construct the polynomial f(x) as follows: (3)f(x)=a1⋅x+a2⋅x2+…+at−1xt−1modp, where the private key is denoted as SK={λ,σ} and SKi=sq⋅f(i)modN2, the coefficients a1,…,at−1∈Zp and s∈ZN are randomly chosen.

In the proposed protocol, users first utilize SADH to encrypt their local models and embed secret messages, subsequently uploading both the hash and the signature to the server. Following this, the server aggregates the received ciphertexts and returns the aggregation results along with the collected hashes and signatures to the users. Finally, after receiving these, each user decrypts the aggregation result to obtain the global model, extracts the joint embedded message, and performs verification to confirm the correctness of the aggregation result. The specific details of VPAFL (Algorithm 1) is illustrated in protocol in particular, the proposed protocol requires two rounds of interaction, with the specific processes for processes for each round described below:

In Round 0, TA initializes the system, distributes the public parameters PP, pp, the global model M, and {spki}i∈{1,2, … ,n}, assigns private keys sski to each user, and transmits the public parameter N2 to the servers.

In Round 1, each user ui∈U1 encrypts their local model wik−1 while embedding a secret message di, obtaining the ciphertext [[wik−1]]←SADH.Ence(SKi,wik−1,di), where k denotes the current communication round. To optimize efficiency, for models with multiple parameters, the user embeds di solely during the encryption of the first parameter, and subsequent parameters replace the embedded message with a random number ri∈ZN. As demonstrated in Section 6.3, embedding the message in even one parameter suffices to verify the aggregation results. Subsequently, the user ui∈U1 computes the LHH value hi of the embedded message di and generates a digital signature sighi for hi. These values will later be used to verify the aggregated result. Finally, the user ui∈U1 sends {[[wik−1]],hi,sighi} to the server. Upon receiving the ciphertexts, the server aggregates them and returns {[[wk−1]],{hj,sighj}uj∈U1,j≠i} to each user ui∈U1.

In Round 2, each user ui∈U1 first checks the validity of the received digital signature {sighj}uj∈U1,j≠i to ensure the integrity of the associated hash values {hj}uj∈U1,j≠i. If valid, the user decrypts the aggregation result to obtain the global model and the joint embedded message (wk−1,d)←SADH.Dece(SK,[[wk−1]]). Next, the user verifies the aggregation result by checking whether LHH.Hash(pp,d)=?LHH.Eval(pp,h1,…,hc,1,…,1), where c=|U1| denotes the total number of participating users. If equality holds, the verification succeeds and the user accepts the aggregation result as valid.

We define correctness as the ability to ensure that the user gets the correct aggregation result to update the local model when all entities involved in the FL honestly perform the predetermined operations in the protocol.

Theorem 1. The user can obtain the correct aggregation result if at least t users participate in FL and the server performs the aggregation operation honestly, where t is the threshold of the SS protocol [35].

Proof of Theorem 1: Assume k=1. From Eq. (4), the user ui applies the encryption-embedding hybrid algorithm SADH.Ence(SKi,wi,di) to encrypt the local model wi and embed the message di as follows: (7)[[wi]]=gwi⋅edi⋅SKi(n−1)!∏j∈U1,j≠ijj−imodN2.

Then, as shown in Protocol 1, the ciphertext received by server aggregation in Round 1 is as follows: (8)[[w]]=∏ui∈U1[[wi]]modN2=∏ui∈U1gwi⋅edi⋅SKi(n−1)!γimodN2=g∑ui∈U1wi⋅e∑ui∈U1di⋅sq(n−1)!⋅∑ui∈U1f(i)γimodN2,where γi=∏j∈U1,j≠ijj−i, and SKi=sq⋅f(i)modN2. Based on SS protocol [35] and Lagrange interpolation formula, we can define a polynomial as follows: (9)F(x)=∑ui∈U1f(i)∏j∈∈U1,j≠ij−xj−imodp

From Eq. (3), F(0)=0. When |U1|≥t, there is ∑ui∈U1f(i)γi=a⋅p, where a∈Zp, thus Eq. (8) can be modified as follows: (10)[[w]]=g∑ui∈U1wi⋅e∑ui∈U1di⋅sa(n−1)!⋅NmodN2=g∑ui∈U1wi⋅gσ⋅∑ui∈U1di⋅sa(n−1)!⋅NmodN2,where e=gσmodN2. Finally. users decrypt [[w]] as: (11)w=∑ui∈U1wi=L([[w]]λmodN2)L(gλmodN2)modNmodσ=(∑ui∈U1wi+σ⋅∑ui∈U1di)modσ=∑ui∈U1wi.

This concludes the proof. ◻

This section begins by analyzing the security of SADH and subsequently evaluates the security of VPAFL under two adversarial scenarios: (1) a malicious server operating independently and (2) a malicious server colluding with up to t−1 users.

Theorem 2. If DTSA is indistinguishability under chosen-plaintext attack (IND-CPA) security, then the SADH is IND-CPA security.

Proof of Theorem 2: As mentioned earlier, according to Eq. (4), the user replaces the random number used in the encryption process with the product of a decimal number and the random number ri∈ZN. This substitution does not compromise security, as the decimal multiplier does not alter the underlying randomness of ri. Therefore, the modifications introduced by SADH to DTSA [20] do not weaken the security of the scheme. Furthermore, DTSA [20] is IND-CPA security, then the security of SADH is guaranteed.

Theorem 3. (Security Against Malicious Server) In the absence of collusion between the malicious server and semi-honest users, the privacy of all honest users is preserved.

Proof of Theorem 3: To formally prove privacy guarantees, we employ a standard hybrid argument [37], proved as follows: Under the (SADH, LHH)-hybrid model, assuming that the security parameter of VPAFL is κ, the threshold of SS protocol is t, and the total number of users is n. For simplicity, we define Server as S,V=S∩U1, where U1={u1,…,uc},c≤n and U1∈U. The joint view of all entities inV can be denoted as a random variable REALVU,t,κ. There is also a probabilistic polynomial-time (PPT) simulator SIMVU,t,κ. In order to prove the security of VPAFL, it is necessary to prove that the outputs of SIMVU,t,κ and REALVU,t,κ are indistinguishable, which is formally expressed as follows: (12)REALVU,t,κ≡SIMVU,t,κ.

hyb0 First, we create a series of random variables, which are indistinguishable from the joint real view of V in REALVU,t,κ in the actual implementation of the VPAFL.

hyb1 In this hybrid, we change the behavior of the user ui through the simulator, and replace the real local model wi with the random vector vi. Then, the user ui is invoked to encrypt the random vector vi and embed the message di. Note that in Section 5, di is defined as the product of two components: (1) a decimal number converted from a binary sequence, and (2) a random number ri∈ZN. However, in the simulation phase, the simulator replaces di with an random value ra∈ZN. The encryption process is adjusted as follows: (13)[[vi]]=←SADH.Ence(SKi,vi,ra),where SKi denotes the secret key of user ui. The simulator then invokes the user ui to calculate the hash value of ra: hi←LHH.Hash(pp,ra), and generates the digital signature of hi: sighi←DS.Sign(hi,sski). Finally, the user ui sends {[[vi]],hi,sighi} to the server. Reviewing the proof of Theorem 2, SADH guarantees that [[vi]] is computationally indistinguishable from [[wi]]. In particular, it has been proved that the output of LHH is random and indistinguishable under different inputs. Thus, VPAFL guarantees the same distribution between hyb1 and hyb0.

hyb2 In this hybrid, the server aggregates the received ciphertext and returns the aggregation result, the received LHH value and the digital signature to each user: (14)[[v]]←SADH.Agg({[[vi]]ui∈U1}).

Similarly, the security of SADH algorithm ensures the same distribution between hyb2 and hyb1.

As mentioned above, based on the security of the SADH and LHH algorithms, we prove that the view in the PPT simulator SIMVU,t,κ is indistinguishable from the real view of V in the REALVU,t,κ, i.e., that the REALVU,t,κ≡SIMVU,t,κ. ◻

Theorem 4. (Security against Colluding Malicious Server and Users) Even if a malicious server colludes with up to t−1 users, the privacy of all honest users is preserved.

Proof of Theorem 4: According to Eq. (7), the user ui encrypted local model wi as follows: (15)[[wi]]=gwi⋅edi⋅SKi(n−1)!∏j∈U1,j≠ijj−imodN2=gwi⋅edi⋅sq⋅f(i)⋅γi(n−1)!,where U1={u1,…,uc}, where t(t≤c≤n) denote the threshold of the SS protocol [35], and γi=∏j∈U1,j≠ijj−i. According to the SS protocol [35], if the malicious server colludes with ≥t users, Eq. (15) can be modified as follows: (16)[[wi]]=gwi⋅edi⋅sa⋅N⋅(n−1)!,where a∈Zp. At this point, the encrypted local model [[wi]] can be decrypted using the private key SK, otherwise it cannot be decrypted. ◻

According to Theorem 3 and Theorem 4, we further demonstrate the resistance of VPAFL to inference attacks under two threat scenarios: (1) attacks initiated solely by the server and (2) collusion between the server and malicious users.

Regarding the global model, since all users transmit encrypted model parameters, the server exclusively operates on ciphertexts during aggregation. This prevents the server from directly analyzing sensitive information. Even if the server colludes with a user to obtain the private key SK, the inherent lack of auxiliary training data ensures that meaningful inference remains infeasible.

For local updates, in the VPAFL protocol, users employ SADH to encrypt local model updates. Under the first threat model (only malicious server), Theorem 3 guarantees that the server cannot decrypt the encrypted parameters of any user without access to the corresponding private key SKi. Under the second threat model (server-user collusion), Theorem 4 ensures confidentiality even if up to t−1 users conspire with the server: the colluding parties cannot decrypt the local updates of honest users. Since adversaries cannot analyze relevant sensitive information from ciphertext, VPAFL satisfies security requirements against inference attacks in both scenarios.

Theorem 5. We define verifiability as the ability of each client to independently verify the correctness of the aggregation results under the threat model defined in Section 4.2.

Proof of Theorem 5: According to the operation of the malicious server on the aggregation results, we consider two scenarios to prove the effectiveness of the verification.

Scenario 1 (Partial Model Aggregation): Let the total number of users be n, and let t denote the threshold of the SS protocol [35]. Assume the server aggregates the models received from c (t≤c<n) users. According to Eqs. (7) and (8), the results obtained by the server aggregation as follows: (17)[[w]]=g∑i=1cwi⋅e∑i=1cdi⋅sq(n−1)!⋅∑i=1cf(i)γimodN2.

According to Eq. (10), the user decrypts the ciphertext using private key SK to to obtain the global model w and extracts the joint embedded message ∑i=1cdi. Subsequently, the user will check if the following equation is true. (18)LHH.Hash(pp,∑i=1cdi)=?LHH.Eval(pp,h1,…,hn,1,…,1).

Based on the definitions in Section 3.2, we have: (19)LHH.Eval(pp,h1,…,hn,1,…,1)=∏i=1nhi=g1∑i=1ndi≠g1∑i=1cdi.

Obviously Eq. (18) does not hold and therefore the aggregation result fails to pass validation.

Scenario 2 (Collusion Attack): The server colludes with c (c<t) users to forge aggregated results that pass verification, where t denote the threshold of the SS protocol [35]. Assume the total number of users is n (c<t<n). To forge an aggregation result that passes the validation, the server must craft a result of the following form: (20)[[w]]=gΔw⋅e∑i=1ndi⋅sq(n−1)!⋅∑i=1nf(i)γi.

Let Δw denote the modified aggregation results. To forge a verified aggregation result, the server must ensure the joint embedded message ∑i=1ndi can be extracted from [[w]]. However, since the server colludes with only c(c<t) users, it cannot access the secret messages {dj}j∉Uc of non-colluding users and must instead guess their values. Suppose the server attempts this forgery by manipulating the aggregation result as follows:(21)[[w]]=gΔw⋅e∑i=1cdi+∑i=c+1nΔdi⋅sq(n−1)!⋅∑i=1nf(i)γi,where ∑i=c+1nΔdi denotes the guess of the server of the secret messages embedded by non-colluding users. As defined in Section 5, the user extracts the joint embedded message ∑i=1cdi+∑i=c+1nΔdi from the ciphertext [[w]]. To verify the correctness of the aggregation results, the user checks if the following equation is true: (22)LHH.Hash(pp,∑i=1cdi+∑i=c+1nΔdi)=?LHH.Eval(pp,h1,…,hn,1,…,1),where LHH.Eval(pp,h1,…,hn,1,…,1)=∏i=1nhi=g1∑i=1ndi≠g1∑i=1cdi+∑i=c+1nΔdi, therefore the forged aggregation result cannot pass the verification. ◻

We compare VPAFL with existing LHH-based VFL schemes, including VerifyNet [18], VeriFL [24], VPFLI [25], and PriVeriFL [26], as shown in Table 1. VerifyNet [18] and VeriFL [24] are based on the double-masking protocol [23], which effectively protects the local gradients of users but fails to protect the privacy of aggregation results. Moreover, these schemes require multiple rounds of interaction between users and the server, increasing communication overhead. In particular, they do not address the risk that corrupted clients colluding with a malicious server are forged to bypass verification. To mitigate collusion attacks during verification, VPFLI [25], PriVeriFL [26], and our proposed VPAFL employ LHH combined with digital signatures, ensuring collusion-resistant verification.

Regarding aggregation privacy, VPFLI [25] introduces a blinding factor to mask the aggregation results, while VPAFL and PriVeriFL [26] delegate decryption authority to users. This approach prevents the server from directly decrypting the aggregation results, thus enhancing privacy protection. However, it is important to note that neither VPFLI [25], PriVeriFL [26], nor VPAFL can fully preserve aggregation results in privacy under collusion attacks. Since FL inherently involves collaborative training of a unified global model, the server only needs to collude with a single user to obtain the global model.

In terms of verification complexity, we assume that the computational complexity of each call to LHH is O(d), where d represents the model dimension. In VerifyNet [18] and VeriFL [24], users perform LHH twice per verification: once to generate the hash value and once to verify the result. Thus, the verification complexity is O(2d) per communication round. To optimize this, VeriFL [24] employs an amortized verification mechanism. Specifically, users sample a set of random coefficients to compute the linear combination of hash aggregations across multiple communication rounds (for example, after tr rounds). They then verified whether the combined hash matches the hash of the linear combination (using the same coefficients) applied to the aggregation results of those rounds. Consequently, VeriFL [24] reduces the verification complexity to O(d+d/tr). In contrast, VPAFL further optimizes the process by integrating the proposed RDHED with LHH (see Section 7.4.1 for details), thus reducing the verification complexity to O(1). Moreover, VPAFL requires only two interaction rounds, establishing it as a more efficient protocol compared to existing solutions.

This subsection describes the experimental settings for VPAFL.

Model Architectures and Datasets: We employ two deep neural network architectures: AlexNet [38] for the CIFAR-100 [39] classification task and FedCNN for the MNIST [40] and CIFAR-10 [39] classification task.

Federated Learning Settings: Based on the open-source personalized FL framework (https://github.com/TsingZ0/PFLlib, accessed on 7 May 2025) [41], we simulate a horizontal FL environment where users employ the SGD algorithm [34] for local model updates during each communication round, with the server using the FedAvg algorithm [7] for model aggregation.

All experiments were conducted on an Ubuntu 22.04 workstation equipped with an Intel Xeon Platinum 8352V 2.10 GHz CPU, 60 GB RAM, and a single NVIDIA 4090 GPU. Our implementation uses Python 3.9 with stable libraries. The LHH is implemented using NIST P-256 curves. FedCNN is a convolutional neural network with the following architecture: Conv(x,32,5×5)→ReLU→MaxPool(2,2)→Conv(32,64,5×5)→ReLU→MaxPool(2,2)→FC(1024,512)→ReLU→FC(512,10), where x denotes the dimension of the input, Conv denotes the convolutional layer, ReLU denotes the type of activation function, MaxPool denotes the pooling layer, and FC denotes the fully connected layer.

Fidelity: We measure fidelity using the accuracy of the model on the classification task, denoted by Acc.

Computational and Communication Overhead: Similarly to previous studies [18,24], we measure computational and communication overhead to evaluate the efficiency of the VPAFL.

Baseline: Regarding the selection of the baseline for overhead comparison, we adopt VPFLI [25] because it also uses the DTSA algorithm [20] as the privacy-preserving strategy. In particular, VPFLI [25] introduces a weight aggregation protocol to mitigate the degradation of model performance caused by heterogeneous user data quality. To ensure comparability, we exclusively retain the core modules relevant to VFL during baseline reproduction.

To validate that the proposed scheme maintains aggregation accuracy without compromising privacy guarantees, we evaluate its performance on three datasets: MNIST [40], CIFAR-10, and CIFAR-100 [39], adopting identical training configurations (e.g., learning rate, batch size) for direct comparison with the FedAvg algorithm [7]. As shown in Fig. 2, the proposed VPAFL protocol achieves an aggregation effectiveness comparable to that of FedAvg [7], with a stable convergence behavior observed across all datasets. This consistency originates from the mathematically lossless encryption and decryption of the plaintext model parameters, thereby preserving data integrity throughout the FL process.

To systematically analyze system efficiency, we define n as the number of participating users, κ=512 as the security parameter and d as the model dimension. To isolate variable impacts, we evaluate computational and communication overhead under two scenarios: (1) Different number of users (n from 100 to 1000) with fixed model dimension d=5000. (2) Different model dimension (d from 1000 to 10,000) with fixed number of users n=500.