aiqbench analysis
This paper treats federated learning on hospital records as an attack surface: fake hospital identities can outvote honest ones, and robust aggregators fail once Sybils reach half the participants. Its main finding is that identity gating blocks unauthorized submissions up to 60% Sybils but does not stop credentialed hospitals from poisoning their own labels, which a coordinate-wise median partly addresses. The results come from a prototype on MIMIC-IV, so the reported overhead and robustness figures should be read as preliminary.
Trustworthy Blockchain-based Federated Learning for Electronic Health Records: Identity-Gated Participation against Sybil Attacks
arXiv:2602.02629v2 Announce Type: replace-cross Abstract: Federated learning allows hospitals to train a shared clinical model without exchanging patient records, but its aggregation assumes that each participant is a distinct institution. In an open federation, an adversary can register many fake identities (a Sybil attack) and outweigh honest hospitals. Byzantine-robust aggregation mitigates such attacks only while the adversary is a minority. We ask whether binding participation to accountable institutional identity closes that gap, and at what cost. We present TBFL, a framework in which an accountable authority issues Verifiable Credentials to the Decentralized Identifiers of hospitals, and a smart-contract registry on a peer-to-peer ledger admits model updates only from credentialed senders. We evaluated a prototype on in-hospital mortality prediction with MIMIC-IV records split across simulated hospitals, comparing the identity gate with federated averaging, three robust aggregators, norm clipping, and a similarity-based defense. Robust aggregators held against a Sybil minority, and norm clipping only against random vectors; all failed when half the participants were Sybils trained on real records with flipped labels. The similarity-based defense stopped mutually similar Sybils but yielded to perturbed ones. The gate rejected all unauthorized submissions and maintained attack-free performance for every strategy up to 60% Sybils. It did not stop credentialed hospitals that flipped their own labels, whereas the gate followed by the coordinate-wise median withstood both. On a local node, on-chain checks added about 1% to training time; fees made training impractical on a public mainnet but affordable on a rollup. Identity gating complements robust aggregation rather than replacing it.
Abstract:Federated learning allows hospitals to train a shared clinical model without exchanging patient records, but its aggregation assumes that each participant is a distinct institution. In an open federation, an adversary can register many fake identities (a Sybil attack) and outweigh honest hospitals. Byzantine-robust aggregation mitigates such attacks only while the adversary is a minority. We ask whether binding participation to accountable institutional identity closes that gap, and at what cost. We present TBFL, a framework in which an accountable authority issues Verifiable Credentials to the Decentralized Identifiers of hospitals, and a smart-contract registry on a peer-to-peer ledger admits model updates only from credentialed senders. We evaluated a prototype on in-hospital mortality prediction with MIMIC-IV records split across simulated hospitals, comparing the identity gate with federated averaging, three robust aggregators, norm clipping, and a similarity-based defense. Robust aggregators held against a Sybil minority, and norm clipping only against random vectors; all failed when half the participants were Sybils trained on real records with flipped labels. The similarity-based defense stopped mutually similar Sybils but yielded to perturbed ones. The gate rejected all unauthorized submissions and maintained attack-free performance for every strategy up to 60% Sybils. It did not stop credentialed hospitals that flipped their own labels, whereas the gate followed by the coordinate-wise median withstood both. On a local node, on-chain checks added about 1% to training time; fees made training impractical on a public mainnet but affordable on a rollup. Identity gating complements robust aggregation rather than replacing it.
28 pages, 10 figures, 14 tables. v2: substantially revised. Fixes credential replay after revocation in the registry contract, adds testnet deployments (Ethereum Sepolia, Arbitrum Sepolia), credentialed-insider and label-flipping experiments, and replaces the illustrative results of v1 with multi-seed results. Code and run logs: this https URL
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG)
C.2.4; I.2.6; K.6.5; J.3
arXiv:2602.02629 [cs.CR]
(or arXiv:2602.02629v2 [cs.CR] for this version)
Full text under the publisher's open licence · 317 words