TriSAFE: Transcript-Bound Verifiable Secure Aggregation With Differential Privacy and Timing Defenses for Gateway-Assisted IoT Federated Learning

Abstract

Federated learning across IoT devices must simultaneously protect each device’s update from disclosure, prevent malicious participants from biasing the global model, and hide which devices are participating from outside observers. Existing systems typically address only a subset of these goals: secure aggregation hides individual updates but cannot validate them, plaintext-based robust filtering requires the server to see updates, and most cryptographic pipelines ignore timing privacy. This paper presents TriSAFE, a protocol composition for IoT federated learning with a single coordinating server and three threshold helpers. The server holds no decryption key. TriSAFE combines four mechanisms that are usually studied in isolation: (i) encrypted client updates accompanied by zero-knowledge proofs that each coordinate lies within a bounded range; (ii) a new lightweight binding step (the plaintext-equivalence protocol, PEP) that cryptographically ties the values proven in zero knowledge to the exact ciphertext later aggregated by the server, closing a substitution gap left by range proofs alone; (iii) helper-added differential privacy noise applied homomorphically before any decryption, so the server only ever sees a noised aggregate; and (iv) fixed-cadence batching with calibrated cover traffic to hide participation from passive network observers. Across two IoT intrusion-detection benchmarks (Edge-IIoTset and N-BaIoT) and MNIST, TriSAFE keeps accuracy within 0.1-2.1 percentage points of the no-attack baseline under Byzantine, label-flip, FANG, and time-delay attacks, with attack success rate below 1% (<0.1% for FANG). Timing inference by a passive observer drops close to chance, and the end to end overhead is 7-36% relative to a non-defended baseline. On MNIST, TriSAFE achieves 89-91% accuracy, 15-17 points above the MODEL benchmark under the same attack suite. The design is practical for gateway-assisted IoT deployments under the assumption that the coordinator does not collude with two helpers and that at least two helpers contribute honest DP noise.