UnlinkableDFL: A Framework for Network-Layer Unlinkability in Decentralized Federated Learning
For privacy-conscious users of decentralized federated learning, this work provides a network-layer unlinkability framework with formal bounds, though it is incremental as it combines existing mixnet and fragmentation techniques.
The paper addresses sender-message linkability in decentralized federated learning by proposing UnlinkableDFL, a framework that uses onion-encrypted fragments, mix relays, and cover traffic to bound linking probability. Experiments show it sustains learning under sparse deployment with a privacy-cost trade-off, but payload-level fingerprints remain a vulnerability.
Decentralized Federated Learning (DFL) removes the central aggregator of conventional Federated Learning, but peer-to-peer model exchange still exposes network traces: who communicates, when fragments move, and which packets correlate across rounds. This paper studies network-layer sender--message linkability for DFL model sharing and presents UnlinkableDFL, a framework in which every participant acts as both a learner and a peer-based mix relay. Shareable model states are split into uniform, onion-encrypted fragment packets and carried over a peer-run mixnet with cover traffic, randomized delays, and independently sampled multi-hop paths. Nodes then perform fragmented aggregation over local and received fragments without sender identities. The analysis bounds sender-linking probability through route uncertainty and relay shuffles, and characterizes when fragment-level aggregation preserves FedAvg-style behavior. A prototype implements QUIC transport, Sphinx-style packets, and Single-Use Reply Block (SURB) acknowledgments. Experiments show that the design sustains learning under sparse deployment while exposing a privacy--cost trade-off: path diversity and relay mixing raise network-layer uncertainty, whereas delay and forwarding dominate overhead. Stress tests confirm robustness to churn and Byzantine updates. A curious-recipient attack marks the boundary of the network-layer guarantee, where payload-level fingerprints survive network-layer anonymization and need complementary defenses, although partial updates and more IID data weaken this attack surface.