TriVer: a lightweight and client-verifiable secure aggregation with dropout tolerance for federated learning

Abstract Federated learning relies on a central server to aggregate client updates, making secure aggregation (SA) essential for privacy protection. Masking-based SA schemes dominate large-scale deployments due to their low overhead, yet they face a fundamental tension: efficient schemes assume a semi-honest server and provide no client-side cryptographic verification, while existing verifiable schemes admit algebraic degrees of freedom that allow a malicious server to forge results that pass all client-side checks. We present TriVer, a lightweight SA protocol that resolves this tension by augmenting a single-mask HPRF-based framework with a triple-binding verification mechanism grounded in elliptic curve cryptography. Each client independently verifies the aggregated result through three non-interactive checks: threshold signature verification, commitment aggregation consistency, and model-hash binding. Passing all three checks simultaneously is computationally equivalent to solving the elliptic curve discrete logarithm problem (ECDLP). We prove that TriVer satisfies client data privacy, aggregation correctness, and aggregation-result non-forgeability in the Random Oracle Model under ECDLP hardness, HPRF pseudorandomness, and hash collision resistance, against a fully malicious server that may collude with a subset of aggregators and clients. Experimentally, TriVer achieves a per-round latency of 1.96 s, approximately six times lower than LightVeriFL (11.68 s) and roughly twice the cost of Aion (0.97 s), with no forged result accepted across all evaluated attack types in our simulations, including the algebraic bypass attack; under the same attack, LightVeriFL’s single-constraint verification equation did not prevent forgery in our evaluated scenario. TriVer tolerates client dropout rates up to 40% with negligible recovery overhead, whereas LightVeriFL fails to complete aggregation at a 20% dropout rate.