The core insight behind the Vietnamese team’s design is that federated learning’s privacy guarantees are thinner than they first appear. During each round of training, participating devices compute gradient updates, or weight changes, on their local data and send them to a coordinating server for aggregation. Research on gradient inversion attacks has demonstrated that a sufficiently determined adversary who intercepts these updates can reconstruct recognizable images and text from them, effectively reversing the learning process to expose the very data the scheme was meant to protect. Beyond eavesdropping, federated systems are also vulnerable to poisoning attacks, in which malicious clients submit corrupted updates to degrade the shared model, and to attacks on the aggregation server itself, which represents a single point of failure and a tempting target for anyone seeking to manipulate the final model.

Homomorphic encryption addresses the eavesdropping problem with a mathematical trick that sounds almost paradoxical: it allows arithmetic to be performed directly on encrypted values. In a conventional encrypted system, data must be decrypted before anything useful can be done with it, which means the party doing the computation inevitably sees the plaintext. Homomorphic schemes, by contrast, operate on ciphertexts, producing encrypted results that, when finally decrypted by the key holder, match the outcome of the same operations performed on the underlying data. For federated learning this is a natural fit, because model aggregation is essentially weighted arithmetic, adding and averaging the numerical updates contributed by many clients. If each client encrypts its update before transmission, the server can combine them into a new global model without ever seeing a single plaintext gradient.

Not all homomorphic encryption is created equal, and the choice of scheme has enormous consequences for performance. The researchers evaluated their system under three experimental conditions: no encryption at all, Paillier encryption, and Cheon-Kim-Kim-Song, or CKKS, encryption. Paillier is a classical partially homomorphic scheme that supports additive operations on integers, which is sufficient for averaging model weights but imposes significant computational overhead on the large tensors that modern neural networks use. CKKS, introduced in 2017, takes a different approach, performing approximate arithmetic on real and complex numbers, which aligns far more naturally with the floating-point values that flow through a deep neural network. That alignment lets CKKS pack many values into a single ciphertext and process them in parallel, dramatically reducing the computational burden relative to schemes designed for exact integer arithmetic.

To measure how much this matters in practice, the team built their experiments around a convolutional neural network, the workhorse architecture for image and signal classification, and tested the system on three benchmark datasets chosen to span very different security scenarios. MNIST, the classic dataset of handwritten digits, and CIFAR-10, a more demanding collection of small natural images, represent standard machine learning workloads. The third dataset, CICMalDroid2020, is a collection of Android malware samples, which grounds the evaluation in a domain where privacy and security are not abstract concerns but operational requirements: hospitals, banks, and security vendors cannot share malware samples or user data freely, yet they would all benefit from a jointly trained detection model.

The headline security result is striking. Under adversarial attack, the system running without encryption suffered an attack success rate of 83.67 percent, meaning the vast majority of attempted intrusions into the training process succeeded. With CKKS encryption in place, that figure collapsed to 55.63 percent, a reduction of nearly thirty percentage points. The encryption does not make attacks impossible, but it strips attackers of the readable gradients and model parameters they rely on, forcing them to operate blind against ciphertexts whose contents reveal nothing about the data or the model state. Meanwhile, the efficiency numbers suggest the security does not come at an unacceptable price: training efficiency remained above 90 percent across all three datasets in the CKKS-based configuration, indicating that the cryptographic overhead, while real, leaves the bulk of the system’s training throughput intact.

Encryption alone, however, would leave federated learning exposed on a different front: trust in the infrastructure that stores and manages models. This is where the blockchain component of uitPriPreFL enters. A blockchain is a distributed, append-only ledger in which records are bundled into cryptographically linked blocks and validated by consensus among participants, making it computationally infeasible for any single party to silently alter history. In the proposed system, the blockchain serves as the storage and management backbone for model information, creating an auditable record of model versions and updates. Any participant can verify that the global model they are downloading corresponds to a legitimate aggregation of encrypted client contributions, and no central operator can quietly substitute a manipulated model or erase a previous version. The combination is synergistic: homomorphic encryption protects the content of the models, while the blockchain protects their provenance and integrity.

The broader context makes this work part of a fast-moving research wave. Recent years have seen a flurry of systems combining cryptography with decentralized ledgers to harden collaborative machine learning, from blockchain-based auditable federated learning frameworks with incentive mechanisms, to multi-key homomorphic encryption schemes that prevent even the aggregation server from decrypting individual updates, to adaptive segmented CKKS approaches designed to squeeze more efficiency out of approximate homomorphic arithmetic. Surveys of client-server attacks and defenses in federated learning document a threat landscape that includes gradient inversion, membership inference, model poisoning, and Byzantine failures, and the field has increasingly converged on the view that no single defense suffices. Layered architectures, combining encryption for confidentiality, consensus mechanisms for integrity, and aggregation rules for robustness, are emerging as the practical answer.

The Vietnamese team’s contribution to that conversation is a complete, working system rather than a theoretical proposal, and they have released the source code publicly on GitHub, allowing other researchers to reproduce their experiments, probe the implementation for weaknesses, and build on the architecture. Open availability matters in this subfield because security claims are notoriously difficult to verify from papers alone, and adversarial evaluations frequently find gaps between a system’s promised and actual robustness. By publishing code alongside benchmarks spanning handwriting recognition, natural images, and malware detection, the authors have made it possible for the community to test whether the reported attack-resistance and efficiency numbers hold up under independent scrutiny.

The implications reach well beyond the laboratory. Federated learning is already deployed in keyboard prediction on smartphones, in healthcare consortia that train diagnostic models across hospitals, and in financial fraud detection networks where data-sharing agreements make centralization impossible. Every one of those deployments inherits the vulnerabilities that gradient inversion and poisoning research have exposed, and every one of them stands to benefit from encryption that lets a server aggregate without seeing and ledgers that make model history verifiable. The uitPriPreFL results, showing a drop in attack success from nearly 84 percent to under 56 percent while keeping training efficiency above 90 percent, offer a concrete data point that strong cryptographic privacy and practical machine learning performance can coexist. As approximate homomorphic encryption schemes like CKKS continue to mature and hardware acceleration improves, the tax that privacy pays on training speed is likely to shrink further, bringing fully private, auditable, collaborative AI closer to everyday infrastructure.

Subject of Research: Privacy-preserving federated learning using homomorphic encryption and blockchain

Article Title: uitPriPreFL: privacy-preserving federated learning system using homomorphic encryption and blockchain

Article References: Cam, N. T., Anh, H. H., & Long, T. K. (2026). uitPriPreFL: privacy-preserving federated learning system using homomorphic encryption and blockchain. Cluster Computing, 29(13), Article 781. https://doi.org/10.1007/s10586-026-06603-x

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06603-x

Keywords: federated learning, homomorphic encryption, blockchain, CKKS, Paillier, data privacy, machine learning security, gradient inversion, deep learning, model aggregation, cryptography, malware detection