Encrypt fewer values. Keep federated updates protected.
Make encrypted federated aggregation cheaper. EncCluster groups model weights into a small codebook, encrypts its centroid values, and sends a compact fingerprint representation of their positions. The server recovers the position map and decrypts an authorized aggregate.
Fewer encryption operations: encrypt representative centroids instead of every model weight.
Separate value and position paths: combine functional encryption with Binary Fuse fingerprints that the server can query.
Measure the cost of protection: compare accuracy, upstream traffic and client encryption time across datasets and architectures.
Federated Learning (FL) enables model training across decentralized devices by communicating solely local model updates to an aggregation server. Although such limited data sharing makes FL more secure than centralized approached, FL remains vulnerable to inference attacks during model update transmissions. Existing secure aggregation approaches rely on differential privacy or cryptographic schemes like Functional Encryption (FE) to safeguard individual client data. However, such strategies can reduce performance or introduce unacceptable computational and communication overheads on clients running on edge devices with limited resources. In this work, we present EncCluster, a novel method that integrates model compression through weight clustering with recent decentralized FE and privacy-enhancing data encoding using probabilistic filters to deliver strong privacy guarantees in FL without affecting model performance or adding unnecessary burdens to clients. We performed a comprehensive evaluation, spanning various datasets and architectures, to demonstrate EncCluster's scalability across encryption levels. Our findings reveal that EncCluster significantly reduces communication costs - below even conventional FedAvg - and accelerates encryption by more than four times over all baselines; at the same time, it maintains high model accuracy and enhanced privacy assurances.
Abstract and overview follow the public preprint; the citation identifies the published version.
Read more ↗Local cross-entropy training produces a weight vector. A separate clustering step assigns those weights to κ centroids. Encryption cost then follows the number of centroids, while the map still covers every weight position.
Section 3.4 and Algorithm 1, PDF pages 6–7. The main configuration uses 128 clusters and 256-bit DMCFE keys.
Insert each (position, cluster) pair into a Binary Fuse filter. The server uses common randomness shared with that client to recover an approximate map. The filter is a compact membership structure; its reconstruction error is not a differential-privacy guarantee.
Sections 3.4–3.5, PDF pages 7–8. The preprint gives inconsistent filter false-positive configurations, so no universal false-positive rate is asserted here.
For each position j, substitute the ciphertext of its estimated centroid. Partial functional keys authorize the weighted aggregate, whose plaintext becomes the next global model.
Plaintext result of Algorithm 2 and Section 3.5, PDF page 8. Nₙ is client sample count; θ̃ₙ is its reconstructed clustered model. Individual inputs remain encrypted during aggregation.
The design assumes an honest-but-curious server and setup authority, secure channels and key provisioning. Clients may disclose their weights in collusion but do not poison updates. Aggregate subtraction under extensive collusion can expose a clustered contribution; lossy clustering alone does not establish confidentiality of that contribution.
Sections 3.2–3.3 and 4.2, PDF pages 5–6 and 9–10. Poisoning and denial of service are outside the analysis.
Results from arXiv:2406.09152v1 ↗
EncCluster reduces encrypted-upload cost in this fixed condition. Its upstream ratio is 0.284× FedAvg and encryption takes 2.04 seconds, versus 2.581× and 7.64 seconds for SEFL. Unencrypted clustering is cheaper still, but provides a different protection level.
CIFAR-10, ResNet-20, 30 clients, full participation, 128 clusters, 256-bit key. IID uses Dir(10); non-IID uses Dir(0.1). Accuracy changes are percentage points versus FedAvg; upstream ratios and seconds are lower-is-better.
FedAvg + clustering is an unencrypted compression reference. The table provides one communication/time column across the two splits, no uncertainty, and no end-to-end training or server-cost measurement.
| Method | IID accuracy Δ (pp) | Non-IID accuracy Δ (pp) | Upstream / FedAvg | Encryption (s) |
|---|---|---|---|---|
| FedAvg + weight clustering | -0.12 | -0.71 | 0.034 | — |
| DeTrust-FL | -0.09 | -0.10 | 3.743 | 329.53 |
| SEFL | -0.98 | -1.74 | 2.581 | 7.64 |
| EncCluster | -0.32 | -0.79 | 0.284 | 2.04 |
The compression cost remains modest across the tested backbones. Every row compares against that architecture’s own FedAvg baseline; CIFAR-100 loses more accuracy than CIFAR-10. These results do not establish hardware-independent encryption times.
IID CIFAR-10 and CIFAR-100, 10 clients, full participation, 100 rounds. Accuracy changes are percentage points versus each architecture’s own FedAvg baseline; encryption time is client-side seconds. No uncertainty is reported.
These are different model baselines, not a ranking of model quality. The table caption mentions only CIFAR-10, but the table itself also contains CIFAR-100; both rows are transcribed here.
| Architecture | CIFAR-10 accuracy Δ (pp) | CIFAR-100 accuracy Δ (pp) | Encryption (s) |
|---|---|---|---|
| ConvNeXt-Tiny | -0.36 | -1.29 | 2.02 |
| ResNet-20 | -0.32 | -1.19 | 2.03 |
| MobileNet | -0.24 | -0.97 | 2.08 |
| ConvMixer-256/8 | -0.19 | -1.02 | 2.12 |
@article{tsouvalas2025enccluster,
title = {{EncCluster}: Scalable functional encryption in federated learning through weight clustering and probabilistic filters},
author = {Tsouvalas, Vasileios and Mohammadi, Samaneh and Balador, Ali and Ozcelebi, Tanir and Flammini, Francesco and Meratnia, Nirvana},
journal = {Pervasive and Mobile Computing},
volume = {108},
pages = {102021},
year = {2025},
publisher = {Elsevier},
doi = {10.1016/j.pmcj.2025.102021},
url = {https://doi.org/10.1016/j.pmcj.2025.102021}
}