AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

AI summary

Overview

Research area: Distributed systems and systems security — specifically the intersection of federated learning (FL) with public blockchain ledgers and smart contracts.

Technical level: Intermediate to Advanced. The protocol and transaction mechanics are readable with a basic grasp of federated learning; the sections on proof-of-stake ledger assumptions, confirmation depth, and gas accounting assume familiarity with distributed-systems and blockchain terminology.

Scope: The paper designs, implements, and empirically evaluates AuditFL, a smart-contract "clearing layer" that records the coordination and payment bookkeeping of an open federated-learning round on a public ledger while leaving model training, aggregation, and tensor storage off chain.

What This Paper Is About

Most federated-learning deployments still depend on a trusted central coordinator that admits clients, hands out model checkpoints, collects updates, aggregates them, and decides who gets paid. If that coordinator is compromised or biased, it can silently censor participants, hide updates, or publish outcomes nobody can reconstruct.

The paper's goal is not to eliminate the aggregator but to make its per-round decisions publicly attributable, replayable, auditable, and economically constrained. AuditFL does this by moving only small pieces of state — content identifiers, tickets, deposits, scores, refunds, and claims — onto a ledger, while keeping the actual model bytes in an off-chain artifact store.

Key Contributions

1. A layered architecture for open FL clearing. The paper defines AuditFL as a contract-backed clearing layer that separates on-chain coordination and settlement from off-chain training, aggregation, and artifact storage, so that block validation never depends on ML libraries, GPU kernels, or fetching tensors.

2. A complete round-clearing state machine. It specifies six transaction objects — ListingTx, FundingTx, UpdateIntentTx, UpdatePublishTx, GlobalUpdateTx, and ClaimTx — covering task listing, reward-pool funding, ticket reservation against a deposit, update publication, global finalization, and claim settlement, together with a deterministic eight-step round finalization rule.

3. A safety and liveness argument under partial synchrony. The paper shows how ledger ordering, a k-deep confirmation view, ticket expiry, deposits, refunds, and scoring make coordinator and client actions replayable and economically accountable, and gives an approximate round-latency model in terms of block-producing stages, confirmation depth, slot duration, and proposer density.

4. A working prototype and measurement study. The authors implement both a deterministic in-memory state-machine backend and a Solidity BCFLCoordinator contract on a local Ethereum-compatible Anvil chain, and measure transaction counts, EVM gas, artifact volume, and learning accuracy on non-IID MNIST against a Plain FL baseline.

Main Findings

• Overhead follows closed-form models exactly. Measured receipt counts rise from 51 transactions at N = 1 to 5,026 at N = 200 clients over R = 12 rounds, matching the analytical formula 2 + R × (2N + 2) + N. Stored artifact counts rise from 25 to 2,413, matching 1 + R × (N + 1) exactly for every tested client count.

• Per-client calls dominate gas cost. At N = 200, a contract run consumes 829.7M gas; publishUpdate accounts for 408.7M and reserveTicket for 314.3M, together roughly 87.1% of total execution cost. This follows from the protocol shape, since each client reserves and publishes once per round while finalizeRound runs only once per round.

• On-chain identifiers are tiny relative to the artifacts they point to. At N = 200, off-chain artifacts occupy 144.9 MiB while the committed SHA-256 identifier strings occupy only 0.163 MiB — a ratio of approximately 887×.

• The learning trajectory is preserved exactly. Across all runs, AuditFL matches the corresponding Plain FL accuracy exactly, because both execute the same learning rule over the same included updates. Final test accuracy ranges from 89.65% at N = 1 to 89.21% at N = 200; the variation across client counts comes from differences in the non-IID Dirichlet partitioning, not from the clearing layer.

• Failures degrade inclusion but never stall rounds. In stress tests at N = 50, R = 12, three seeds, and injected failure rates from 0% to 50%, client dropout, invalid updates, and artifact unavailability all reduce inclusion approximately linearly while rounds still finalize. Even at 50% injected failures, approximately 25 updates per round remain included.

• Accuracy is robust to injected faults. Final test-accuracy differences relative to Plain FL stay within a few tenths of an accuracy percentage point even at high failure rates. Some differences are slightly positive, which the authors attribute to the non-IID data split — excluding some updates can occasionally remove noisy contributions.

• The trust model is narrowed, not removed. AuditFL does not prove that the aggregation outcome is optimal or correct. An auditor can replay the round's control flow, recompute public scores when validation data are available, rerun the deterministic aggregator, and check the resulting hash against the accepted global identifier — making deviations leave public evidence, which the authors characterize as detectability and accountability rather than cryptographic enforcement.

Methodology in Plain English

The authors built two versions of the same protocol. One is a plain deterministic state machine, used for fast debugging and for fault-injection experiments where the point is round completion rather than blockchain cost. The other is a real Solidity smart contract deployed on a local Ethereum-compatible Anvil chain, used to measure transactions and gas.

Client and coordinator logic is written in Python and is shared between both backends. A client reads the current round, locks a deposit to reserve a ticket, trains locally, writes its update into a local SHA-256 content-addressed artifact store, and publishes the resulting identifier on chain. The coordinator fetches whatever updates it can retrieve, filters out malformed shapes, aggregates the rest with the same FedAvg-style rule the baseline uses, uploads the new global model, and finalizes the round on chain, which advances the round, credits rewards, and marks deposits refundable.

Experiments use the full 70,000-example MNIST dataset loaded through OpenML, split into 42,000 training, 10,500 validation, and 17,500 held-out test examples. Training data is spread across clients with a Dirichlet distribution at α = 0.4 for non-IID partitioning, over 12 rounds and client counts ranging over 1, 2, 5, 10, 15, 20, 30, 40, 50, 75, 100, 150, and 200. Every configuration runs both Plain FL and AuditFL on the identical split, model, local-training rule, round count, and aggregation rule, so any measured difference is attributable to the clearing layer.

For the fault study, the authors ran three fault modes at N = 50 with three seeds and injected failure rates from 0% to 50%: clients dropping out (no update published), clients publishing updates that fail declared validity checks, and clients publishing identifiers whose artifacts cannot be retrieved. The artifact-unavailability case deliberately relaxes the paper's nominal reliable-storage assumption to see whether the clearing layer still makes progress.

Why This Matters

Impact on research. The paper carves out a specific, previously under-specified layer in blockchain-assisted FL: not privacy, not robust aggregation, not verifiable computation, but round clearing — ticketed admission, update commitments, deterministic settlement, and contract execution cost. Table I positions AuditFL against BlockFL, Biscotti, FedCoin, ChainFL, BlockFLA, BlockFLow, Auditable BR-FL, and VerifBFL, and argues that these works leave consensus assumptions and round-level state-machine details less explicit. The explicit gas and transaction models also give other researchers a way to predict control-plane cost before building.

Real-world applications:

• Cross-organization model training in healthcare or finance, where each participant needs an independently checkable record of which updates were accepted into which round and how rewards were split.
• Open model-training markets where any client may join without pre-approval, and where deposits price out spam reservations and unusable submissions.
• Regulated or audit-facing deployments where a supervisor must reconstruct, after the fact, why a particular model version was produced and who was compensated for it.
• Consortium settings where the aggregator is a designated but not fully trusted party, and the ledger serves as a tamper-evident log of its round decisions.

Industry relevance. The gas measurements are reported as a proxy for smart-contract execution cost rather than a monetary figure, deliberately, since real cost depends on the gas price of a particular network. The finding that per-client reserve and publish calls dominate — about 87.1% of 829.7M gas at 200 clients — is directly actionable for anyone estimating whether an on-chain coordination layer is affordable at realistic participant counts. The 887× gap between identifier bytes and artifact bytes also quantifies the core design bet: keep tensors off chain.

Future Directions

• Public-network measurement. The evaluation runs on a local Anvil chain; the authors list public-network measurements as future work, which would replace modeled latency with observed confirmation delays, forks, and gas-price variation.
• Scaling to larger FL workloads. The current study uses MNIST with 12 rounds and up to 200 clients; larger models would change artifact volume and off-chain computation even though the on-chain call structure stays a function of rounds, clients, identifiers, and settlement operations.
• Replicated artifact storage. The design currently assumes a reliable off-chain store; the artifact-unavailability stress test deliberately relaxes that assumption, and the authors point to replicated storage as a next step.
• Stronger or verifiable aggregation. The paper is explicit that learning integrity is separated from consensus — Byzantine clients can still submit poisoned tensors and the coordinator can apply weak validation or selectively include updates. Robust rules such as Krum, coordinate-wise median, or trimmed mean, and cryptographic verifiability over aggregation, are identified as compatible additions that would not change the ledger state machine.
• Open question on scoring truthfulness. The ledger enforces settlement arithmetic but not the correctness of the task-specific scoring policy; when no public validation set or committed evaluation oracle exists, an auditor can only check that payouts and refunds are consistent with the submitted scores and on-chain rules.

Target Audience

This paper is most useful to distributed-systems and blockchain researchers working on decentralized coordination for machine learning, and to engineers designing incentive or audit layers for multi-party model training. It also suits FL practitioners who already accept a coordinator but need the round history to be independently reconstructable and the payout arithmetic to be enforced. Readers looking for privacy guarantees or poisoning defenses should note the authors' explicit framing: AuditFL is not a complete privacy or poisoning-defense mechanism, and stronger guarantees require complementary tools such as secure aggregation, differential privacy, and robust aggregation.

Authors’ abstract

Federated learning (FL) keeps raw data local, but most deployments still rely on a trusted coordinator for client admission, checkpoint distribution, update collection, aggregation, and rewards. This paper presents AuditFL, a contract-backed clearing layer for auditable FL in open settings. AuditFL keeps training and aggregation off chain, stores model artifacts in an assumed reliable off-chain artifact store, and records only content identifiers and economic state on chain. Clients reserve update tickets with deposits, publish update identifiers, and later claim refunds or rewards; the task coordinator publishes global checkpoints and finalizes rounds through deterministic settlement rules. The design does not remove the aggregator, but makes its on-chain round decisions attributable, replayable, auditable, and economically constrained. We implement AuditFL as both a deterministic state-machine prototype and a Solidity contract on a local Ethereum-compatible Anvil chain. On full MNIST with Dirichlet non-IID splits, 12 rounds, and up to 200 clients, AuditFL preserves the Plain FL learning trajectory while its overhead follows closed-form control-plane models. At 200 clients, the contract run issues 5,026 transactions, stores 2,413 off-chain artifacts (144.9 MiB), and consumes 829.7M EVM gas, dominated by per-client reserve and publish calls. Controlled dropout, invalid-update, and artifact-unavailability stress tests reduce inclusion nearly linearly but still finalize rounds, with final-accuracy changes remaining within a few tenths of an accuracy percentage point even under high injected failure rates.