AuditFL: A Contract-Backed Clearing Layer for Open Federated Learning

AuditFL. A Contract-Backed Clearing Layer for Open Federated Learning. By Alexandros Balla and one other, from the Hong Kong University of Science and Technology and the University of Thessaly. Published on the thirtieth of October.

Federated learning keeps raw data on the clients that hold it. Yet most deployments still lean on a trusted coordinator for nearly everything else: admitting clients, distributing checkpoints, collecting updates, aggregating them, and handing out rewards. In an open setting, that leaves one party at the centre of every round, and the question is how its decisions can be made auditable.

AuditFL is a contract-backed clearing layer for auditable federated learning in open settings. The line it draws runs between heavy work and bookkeeping. Training and aggregation stay off chain. Model artifacts sit in an off-chain artifact store, which the design assumes to be reliable. Only content identifiers and economic state are recorded on chain. The aggregator is not removed. What changes is the standing of its on-chain round decisions: they become attributable, replayable, auditable, and economically constrained.

Each round follows a fixed choreography. Clients reserve update tickets by placing deposits, publish identifiers for their updates, and later claim either refunds or rewards. The task coordinator publishes global checkpoints and finalizes each round through deterministic settlement rules. The authors build the system twice: once as a deterministic state-machine prototype, and once as a Solidity contract running on a local Ethereum-compatible chain, Anvil.

The experiments use full MNIST with Dirichlet non-IID splits, twelve rounds, and up to two hundred clients. AuditFL preserves the learning trajectory of Plain FL, and its overhead follows closed-form models of the control plane. At two hundred clients, the contract run issues five thousand and twenty-six transactions. It stores two thousand four hundred and thirteen off-chain artifacts, together one hundred and forty-four point nine mebibytes. And it consumes eight hundred and twenty-nine point seven million units of EVM gas, most of it spent on the per-client reserve and publish calls.

Stress tests then inject controlled failures: client dropout, invalid updates, and artifacts that cannot be retrieved. Inclusion falls nearly linearly as the failures mount, but rounds still finalize. Final accuracy moves by no more than a few tenths of a percentage point, even under high injected failure rates.

AuditFL does not try to put learning on a chain. It puts the bookkeeping there. Who reserved a ticket, who published an update, what the coordinator decided and what each party was paid all become a record that can be replayed, while the training and the model artifacts stay where they were.

AuditFL. A Contract-Backed Clearing Layer for Open Federated Learning. By Alexandros Balla and one other, from the Hong Kong University of Science and Technology and the University of Thessaly. Published on the thirtieth of October. This is the long version: the whole paper rather than the abstract.

Federated learning keeps raw data on the clients that own it. What it usually leaves centralized is the control plane. A coordinator selects clients, hands out checkpoints, collects updates, aggregates them, records progress, and often decides rewards. If that coordinator is compromised or biased, it can censor participants, hide updates, tilt the aggregation, or publish a round outcome whose inputs and accounting nobody can reconstruct. Simply moving everything onto a blockchain fails too. Put model tensors on chain and the ledger becomes a slow bottleneck. Make it permissioned and the open market, where any client may join, is gone.

AuditFL calls itself a clearing layer, and that word carries the design. It does not decentralize the learning. A designated task coordinator still applies the aggregation rule and publishes the next global checkpoint, as a conventional aggregator would. What moves onto a public ledger is everything around the learning: who reserved a slot, which update they committed to, when the round closed, which updates were included, and who is owed what. Model bytes live in an off-chain artifact store, assumed reliable, and the chain holds only content identifiers, which are hashes of those bytes. Two goals follow. The first is minimal consensus: validating a block must never need a machine learning library, a GPU, or a storage fetch. The second is round auditability: from public chain state and retrievable identifiers, an auditor should be able to replay a round's control flow and check its economic outcome.

A round runs through six transaction types. The task coordinator lists a task, binding a model identifier to an initial checkpoint and an immutable rule set covering deadlines, deposits and the scoring policy, then funds a reward pool. A client reserves a ticket by locking a deposit, with per-account caps on how many it may hold. It trains locally, uploads its update off chain, and publishes, binding the ticket to the update's identifier. At the deadline the coordinator sorts the revealed tickets, fetches what it can with bounded retries, filters invalid shapes, scores candidates on its validation set, aggregates, uploads the new checkpoint, and submits a global update naming the included tickets, the refunds and the scores. Clients later claim what they are owed.

The state machine enforces causality. A publication must reference a live, unrevealed ticket for the same model and round. A global update must match the current round and may only name tickets already revealed. Those invariants rule out hidden updates, double publication, stale finalization and unreserved spam. Deposits price behaviour: reserve and never publish, and you forfeit. Publish something retrievable that passes the serialization and shape checks, and you get the deposit back, even if you earn no reward. Rewards come separately, from scores. One illustrative score is an update's improvement over the previous global model on validation data, floored at zero and weighted by a capped proxy for the client's sample size. Each included update is paid its share of the round's pool, with scores raised to a payout exponent between one and two, fixed at listing; a larger exponent concentrates reward on the best updates. The ledger enforces only the settlement arithmetic, not whether the scoring was sound.

The prototype is a Solidity contract on a local, Ethereum-compatible Anvil chain, plus a deterministic in-memory state machine for stress tests. The workload is full MNIST, split into forty-two thousand training images, ten thousand five hundred for validation scoring, and seventeen thousand five hundred held out, spread across clients with a Dirichlet non-IID split, over twelve rounds, from one client up to two hundred. Plain FL runs on the same split, model and FedAvg-style rule, so any difference comes from coordination alone. The real test is whether overhead is predictable, and it is. Measured transaction receipts match the closed-form count at every client count, rising to five thousand and twenty-six transactions at two hundred clients. Artifact counts match exactly too. Gas reaches eight hundred and twenty-nine point seven million, and the per-client reserve and publish calls make up about eighty-seven point one percent of it. Stored tensors outweigh the committed identifiers by roughly eight hundred and eighty-seven times.

The stress tests use fifty clients, three seeds, and injected failure rates from zero to fifty percent, for client dropout, invalid updates, and unretrievable artifacts. All three cut inclusion roughly linearly, and every round still finalizes. At fifty percent, about twenty-five updates per round are still included. Final accuracy stays within a few tenths of a percentage point of Plain FL, sometimes slightly above it, which the authors put down to non-IID data, where dropping an update can also drop noise.

There is no section headed limitations, but the limits are stated plainly across the paper. AuditFL is not a privacy or poisoning defence. Updates can still leak information, Byzantine clients can still submit poisoned tensors, and the coordinator can still choose weak validation rules or include updates selectively. Scores can only be recomputed when validation data or a committed evaluation procedure is public. Fees, deposits and caps make spam costly, but do not guarantee Sybil-proof reward fairness. On the evidence side, the chain is local, so nothing measures public-network delay or real consensus behaviour. Storage is a local store and the workload is MNIST alone. The stress tests use three seeds, which the authors say is too few to rank one fault type as more damaging than another.

The idea to carry away is narrowing trust rather than removing it. AuditFL keeps a coordinator, because someone has to run the aggregation, but forces every round decision through a public ledger with deposits on the line. It does not prove the aggregation was correct, let alone optimal. What it does is make silent history rewrites, hidden updates and arbitrary reward minting leave public evidence. The security claim is detectability and accountability: weaker than a cryptographic proof, the authors write, but stronger than trusting a silent coordinator.