Federated learning (FL) has been widely adopted in various fields of study and business. Traditional centralized FL systems suffer from serious issues. To address these concerns, decentralized federated learning (DFL) systems have been introduced in recent years. With the help of blockchains, they attempt to achieve more integrity and efficiency. However, privacy preservation remains an uncovered aspect of these systems. To tackle this, as well as to scale the blockchain-based computations, we propose a zero-knowledge proof (ZKP)-based aggregator (zkDFL). This allows clients to share their large-scale model parameters with a trusted centralized server without revealing their individual data to other clients. We utilize blockchain technology to manage the aggregation algorithm via smart contracts. The server performs a ZKP algorithm to prove to the clients that the aggregation is done according to the accepted algorithm. Additionally, the server can prove that all inputs from clients have been used. We evaluate our approach using a public dataset related to the wearable Internet of Things. As demonstrated by numerical evaluations, zkDFL introduces verifiability of the correctness of the aggregation process and enhances the privacy protection and scalability of DFL systems, while the gas cost has significantly declined.
Federated Learning (FL) emerges as a viable solution to facilitate data collaboration, enabling multiple clients to collaboratively train a machine learning (ML) model under the supervision of a central server while ensuring the confidentiality of their raw data. However, existing studies have unveiled two main risks: (i) the potential for the server to infer sensitive information from the client's uploaded updates (i.e., model gradients), compromising client input privacy, and (ii) the risk of malicious clients uploading malformed updates to poison the FL model, compromising input integrity. Recent works utilize secure aggregation with zero-knowledge proofs (ZKP) to guarantee input privacy and integrity in FL. Nevertheless, they suffer from extremely low efficiency and, thus, are impractical for real deployment. In this paper, we propose a novel and highly efficient approach RiseFL for secure and verifiable data collaboration, ensuring input privacy and integrity simultaneously. Firstly, we devise a probabilistic integrity check method that transforms strict checks into a hypothesis test problem, offering great optimization opportunities. Secondly, we introduce a hybrid commitment scheme to satisfy Byzantine robustness with improved performance. Thirdly, we present an optimized ZKP generation and verification technique that significantly reduces the ZKP cost based on probabilistic integrity checks. Furthermore, we theoretically prove the security guarantee of RiseFL and provide a cost analysis compared to state-of-the-art baselines. Extensive experiments on synthetic and real-world datasets suggest that our approach is effective and highly efficient in both client computation and communication. For instance, RiseFL is up to 28x, 53x, and 164x faster than baselines ACORN, RoFL, and EIFFeL for the client computation.
Tsz Hon Yuen, Muhammed F. Esgin, Joseph K. Liu, Man Ho Au · 5 authors
We introduce a novel generic ring signature construction, called DualRing, which can be built from several canonical identification schemes (such as Schnorr identification). DualRing differs from the classical ring signatures by its formation of two rings: a ring of commitments and a ring of challenges. It has a structural difference from the common ring signature approaches based on accumulators or zero-knowledge proofs of the signer index. Comparatively, DualRing has a number of unique advantages.
An efficient member revocation mechanism is a desirable feature when group signature schemes are applied in practical scenarios. Revocation methods, such as verifier-local revocation (VLR), provide an efficient member revocation in applications of group signatures. However, VLR-group signatures rely on a weaker security notion. On the other hand, group signature schemes for static groups gain stronger security with the full-anonymity security notion. Even though an outsider sees the secret signing keys of all group members in the full-anonymity, the signer is still anonymous. Achieving the full-anonymity for VLR group signature schemes is challenging due to the structure of secret signing keys. The secret signing keys of those schemes consist of tokens, which are used to manage revocation. The reveal of tokens may destroy the anonymity of the signers. We obtain stronger security for the lattice-based VLR group signature schemes by providing a new key generation method, which outputs revocation tokens without deriving from the members’ secret signing keys. We propose a new group signature scheme from lattices with VLR, which achieves stronger security than the previous related works. To avoid signature forgeries, we suggest a new zero-knowledge proof system that requires signers to validate themselves. Moreover, we output an efficient tracing mechanism.
In this paper, we initiate the study of garbled protocols — a generalization of Yaos garbled circuits construction to distributed protocols. More specifically, in a garbled protocol construction, each party can independently generate a garbled protocol component along with pairs of input labels. Additionally, it generates an encoding of its input. The evaluation procedure takes as input the set of all garbled protocol components and the labels corresponding to the input encodings of all parties and outputs the entire transcript of the distributed protocol.We provide constructions for garbling arbitrary protocols based on standard computational assumptions on bilinear maps (in the common random string model). Next, using garbled protocols we obtain a general compiler that compresses any arbitrary round multiparty secure computation protocol into a two-round UC secure protocol. Previously, two-round multiparty secure computation protocols were only known assuming witness encryption or learning-with errors. Benefiting from our generic approach we also obtain protocols (i) for the setting of random access machines (RAM programs) while keeping communication and computational costs proportional to running times, while (ii) making only a black-box use of the underlying group, eliminating the need for any expensive non-black-box group operations. Our results are obtained by a simple but powerful extension of the non-interactive zero-knowledge proof system of Groth, Ostrovsky and Sahai [Journal of ACM, 2012].
Nils Fleischhacker, Johannes Krupp, Giulio Malavolta, Jonas Schneider · 6 authors
A sanitizable signature scheme is a malleable signature scheme where a designated third party has the permission to modify certain parts of the message and adapt the signature accordingly. This primitive was introduced by Ateniese et al . (ESORICS 2005) and Brzuska et al . (PKC 2009) formalized the initially suggested five security properties. In the subsequent year, Brzuska et al . (PKC 2010) introduced a notion called unlinkability where the basic idea is that linking message‐signature pairs of the same document should be infeasible. Brzuska et al . formalized this notion and suggested a generic instantiation based on group signatures with a special structure. Unfortunately, the most efficient instantiations of group signatures do not have this property. In this work, we present the first efficient construction of unlinkable sanitizable signatures based on a novel type of signature schemes with re‐randomizable keys. This property allows one to re‐randomize both the signing and the verification key separately but consistently. Given a signature scheme with re‐randomizable keys, we obtain a sanitizable signature scheme by signing the message with a re‐randomized key and proving in zero‐knowledge that the derived key originates from either the signer or the sanitizer. To obtain an efficient instantiation, we instantiate this generic idea with Schnorr signatures and efficient ‐protocols that we turn into a non‐interactive zero‐knowledge proof via the Fiat‐Shamir transformation. In this work, we present an optimized version that is more efficient than the construction we suggested in the extended abstract of this work at PKC 2016.
Abstract. Multiparty computation can be used for privacy-friendly out-sourcing of computations on private inputs of multiple parties. A com-putation is outsourced to several computation parties; if not too many are corrupted (e.g., no more than half), then they cannot determine the inputs or produce an incorrect output. However, in many cases, these guarantees are not enough: we need correctness even if all computation parties may be corrupted; and we need that correctness can be verified even by parties that did not participate in the computation. Protocols satisfying these additional properties are called “universally verifiable”. In this paper, we propose a new security model for universally verifi-able multiparty computation, and we present a practical construction, based on a threshold homomorphic cryptosystem. We also develop a multiparty protocol for jointly producing non-interactive zero-knowledge proofs, which may be of independent interest.
Georg Fuchsbauer, Christian Hanser, Daniel Slamanig
Structure-preserving signatures (SPS) are a powerful building block for cryptographic protocols. We introduce SPS on equivalence classes (SPS-EQ), which allow joint randomization of messages and signatures. Messages are projective equivalence classes defined on group-element vectors, so multiplying a vector by a scalar yields a different representative of the same class. Our scheme lets one adapt a signature for one representative to a signature for another representative without knowledge of any secret. Moreover, given a signature, an adapted signature for a different representative is indistinguishable from a fresh signature on a random message. We propose a definitional framework for SPS-EQ and an efficient construction in Type-3 bilinear groups, which we prove secure against generic forgers. We also introduce set-commitment schemes that let one open subsets of the committed set. From this and SPS-EQ, we then build an efficient multi-show attribute-based anonymous credential system for an arbitrary number of attributes. Our ABC system avoids costly zero-knowledge proofs and only requires a short interactive proof to thwart replay attacks. It is the first credential system whose bandwidth required for credential showing is independent of the number of its attributes, i.e., constant-size. We propose strengthened game-based security definitions for ABC and prove our scheme anonymous against malicious organizations in the standard model; finally, we discuss a concurrently secure variant in the CRS model.
For anyone interested in the philosophy of risk–benefit analysis, a two-part paper in this issue makes stimulating reading [1, 2]. The authors describe an effect of antidepressants on fetal neuronal development. Maternal exposure to both tricyclic antidepressants and selective serotonin reuptake inhibitors (SSRIs) during pregnancy was associated with a 10-fold increase in laxative use in children. The findings illustrate how safety issues can remain undetected late in the life cycle of a drug, despite millions of patients being exposed for decades. Clinical pharmacology research, as with any science, needs to define questions that summarize the hypotheses to be tested. The efficacy of medicines can be defined by questions that are easy to formulate and are addressed by clinical trials. Even so, the efficacy of antidepressant medication is contentious, given the high placebo response, failure to prevent suicide and selective reporting of results [3, 4]. For safety issues, the key questions are usually not known until the data are collected. With myriad potential safety questions, it is important that all the available basic pharmacology is reviewed and that this knowledge is used to direct a search for specific clinical safety signals. The Groningen group have adopted this approach with a detailed literature review to form a hypothesis that maternal antidepressant use might influence fetal enteric nervous system development [1]. In a second study, they use epidemiology to assess paediatric laxative use as a potential marker of a specific teratogenic signal associated with the maternal use of antidepressants [2]. The starting point for this work was the linking of a small signal of infantile hypertrophic pyloric stenosis cases to the maternal use of fluoxetine in a northern Netherlands birth defect registry. This association is rational, because fluoxetine crosses the blood–brain barrier and serotonin contributes to the development of enteric neurons. A serotonin-based mechanism could also explain an increased use of laxatives by the children of mothers who had taken an SSRI. When a drug first comes to market, the assessment of the risk-to-benefit ratio is an educated guess. Efficacy can be defined by objective clinical trials, where predefined end-points are quantified. That the efficacy data are invariably adequate at the time of marketing is supported by the rarity of withdrawals of medicines because of later proof of a lack of efficacy. But safety cannot usually be quantified objectively; thus, many parameters might show a signal which can neither be confirmed or ignored [5]. To define fully the safety profile of a medicine at the time of marketing would be so expensive that new drug development would halt if this were a requirement. As a compromise, the subjective assessment of safety data is based on international guidance on minimal requirements, summarized by the International Conference on Harmonisation's guideline, ICHE1 [6]. This sets a reasonable minimal exposure for medicines for non-life-threatening diseases of about 1500 people, of whom some 300–600 should be exposed for 6 months and at least 100 are exposed for 1 year. Though a reasonable requirement for drug development, the limitations of ICHE1 and the importance of postmarketing data are highlighted by the number of drugs that are withdrawn from the market for previously undetected safety problems. The ICHE1 safety population may prove inadequate to detect major concerns. Sometimes major safety concerns are only evident with larger and longer population exposure, for example, clofibrate. Here an early data set, considerably larger than the ICHE1 requirement, initially showed a favourable risk–benefit ratio [7]. But eventually, a clinical trial of some 200 000 patient-years showed a significant increase in mortality [8]. But not all important safety signals require large numbers of patients treated for many years. A safety signal might occur in only a small subpopulation, which at the time of licensing has either not been studied or has been studied in limited numbers. Ever since the thalidomide disaster revolutionized medicines regulation, the prime subpopulation of concern has been the fetus. The number of pregnancies exposed to a new drug at the time of licensing is invariably small or zero. When the drug is likely to be worth the risk of prescribing in pregnancy, it may take decades before the risks are quantified, for example, with anti-epileptic therapy [9]. With the increasing use of antidepressants during pregnancy in recent years, now about 2% of all pregnant women in some countries, it is time to consider how safe such prescribing might be. The labelling information of antidepressants has numerous safety warnings and always recommends caution in pregnancy, but statements that ‘neonates should be observed’ raises the question of what form this observation should take. Without control groups, it is often impossible to separate the risk of the disease, the risk of the therapy and the background incidence of developmental abnormality. Some adverse events only become apparent indirectly through the presence of a cofactor, a proxy or a challenge test. Supressing eosinophils may seem safe until a parasitic infection is encountered; grapefruit juice seems innocuous until a drug solely metabolized by CYP3A4 is co-administered. In the present study, the group used a pharmacy prescription database to detect the use of diarrhoea and constipation medication as a marker of enteric nervous system development. What is commendable in this approach is that basic pharmacology has been reviewed to develop a hypothesis that is then tested with epidemiology. Antidepressants can modify monoamine synaptic transmission of serotonin, noradrenaline or dopamine. The pharmacology of noradrenaline and dopamine is well established. Serotonin may affect anger, aggression, arousal, body temperature, mood, sleep, vomiting, sexuality and appetite and may even modify social decision making [10]. The pharmacology of serotonin has been sufficiently studied that it is possible to define safety questions that need to be answered in clinical studies of a new molecule that affects serotoninergic pathways. These include whether there is an effect on the following parameters: pulmonary hypertension; pulmonary hypertension in the fetus; heart valve abnormalities; chronotropic/inotropic effects via receptors in atria or ventricles; mood changes or suicidality; platelet aggregation; vasoconstriction; QT effects similar to cisapride; the incidence of serotonin syndrome alone or in combination; and bone resorption [11]. But there is more to the monoamines than neurotransmission. Knockout mouse models show the importance of the serotonin re-uptake transporter (SERT) and the noradrenaline transporter (NET) in neuronal development. SERT-deficient mice are susceptible to both diarrhoea and constipation in adult life. A careful review of the literature by the Groningen authors discusses evidence that modification of 5-HT2B receptors, SERT and NET may each adversely affect enteric nervous system development [1]. The safety analysis of medicines is more complex than the assessment of efficacy. Though antidepressants are taken by about 10% of Americans (they are the most commonly used prescription drug class in the USA), they continue to come up with surprises. If proved, the current findings are a major concern. Antidepressants have to cross the blood–brain barrier and affect neuronal function in order to work. This makes them likely to cross the placenta and access the neural crest and neural tube. If these commonly used drugs affect enteric nervous system development, then it is difficult to guarantee the safe development of other tissues. We cannot yet be reassured about potential central nervous system effects on children who have been exposed in utero, nor is there much certainty about long-term effects on the increasing number of children and adolescents exposed to antidepressants during their youth [12, 13]. The approach by the Groningen group, of using pharmacology to define an appropriate safety question, is exemplary. Only when such questions are formulated can sense be made of much of the mass of postmarketing pharmacovigilance data. Finding signals in these huge databases is like searching for a needle in a haystack. Defining a question based on the pharmacology to probe the data and using co-medication usage as a marker is analogous to using a magnet to search for such a valuable needle. The author is a pharmaceutical industry consultant and advises a range of companies on pharmaceutical development. The content of this article does not promote a particular commercial interest.
Open access
Pharmacological Effects and Toxicity Studies
Intestinal Malrotation and Obstruction Disorders
Maternal Mental Health During Pregnancy and Postpartum
Endre Bangerter, Jan Camenisch, Stephan Krenn, Ahmad‐Reza Sadeghi · 5 authors
Efficient zero-knowledge proofs of knowledge (ZK-PoK) are basic building blocks of many practical cryptographic applications such as identification schemes, group signatures, and secure multiparty computation. Currently, first applications that essentially rely on ZK-POKs are being deployed in the real world. The most prominent example is Direct Anonymous Attestation (DAA), which was adopted by the Trusted Computing Group (TCG) and implemented as one of the functionalities of the cryptographic chip Trusted Platform Module (TPM). Implementing systems using ZK-PoK turns out to be challenging, since ZK-PoK are, loosely speaking, significantly more complex than standard crypto primitives, such as encryption and signature schemes. As a result, implementation cycles of ZK-PoK are time-consuming and error-prone, in particular for developers with minor or no cryptographic skills. To overcome these challenges, we have designed and implemented a compiler with corresponding languages that given a high-level ZK-PoK protocol specification automatically generates a sound implementation of this. The output is given in form of -protocols, which are the most efficient protocols for ZK-PoK currently known. Our compiler translates ZK-PoK protocol specifications, written in a high-level protocol description language, into Java code or \LaTeX\ documentation of the protocol. The compiler is based on a unified theoretical framework that encompasses a large number of existing ZK-PoK techniques. Within this framework we present a new efficient ZK-PoK protocol for exponentiation homomorphisms in hidden order groups. Our protocol overcomes several limitations of the existing proof techniques.