FL-Forensics: A Forensic-Ready Framework for Tamper-Evident Accountability and Auditability in Federated Learning

1. Introduction

Federated learning (FL) allows distributed clients to train a shared model while retaining raw data locally. It supports privacy-sensitive applications in healthcare, finance, mobile systems, and edge computing, but remains vulnerable to data and model poisoning, targeted backdoors, membership inference, data reconstruction, and evasion [1,2,17,31]. Heterogeneous clients, data that are not independent and identically distributed (non-IID), resource constraints, intermittent participation, and partial trust complicate defenses [4,6,30,33].

Keeping data local does not eliminate privacy risks: exchanged gradients and model updates can expose class labels, private attributes, and training samples [14,21,28,35]. Poisoned updates can degrade the global model or introduce persistent backdoors. A compromised aggregation server can suppress client contributions, alter aggregation results, modify forensic records, delay anchoring, or select which evidence is committed for verification [18,20]. FL security therefore requires both attack mitigation and trustworthy evidence for post-incident investigation.

Most FL defenses focus on prevention and mitigation during training. Differential privacy reduces information leakage, secure aggregation protects update confidentiality, robust aggregation limits Byzantine influence, and anomaly detection flags suspicious updates. These defenses offer limited support for forensic investigation, evidence preservation, and accountability. Frameworks such as Flower [3] support distributed training but lack a native, independently verifiable evidence lifecycle for detecting record manipulation and supporting third-party forensic audits [10,13,19,22,25].

Forensic readiness prepares systems to generate, protect, and retain evidence before incidents occur [27]. In FL, records should be attributable, tamper-evident, temporally ordered, retained under privacy and access controls, and independently verifiable. External cryptographic anchoring provides an independently verifiable commitment, but cannot establish that evidence was complete or unaltered before commitment. A compromised server can rewrite its ledger, delay an anchor, or omit records.

We present FL-Forensics, an end-to-end forensic-ready extension of Flower for malicious-client and compromised-aggregator settings. It combines client-signed update commitments, a hash-chained ledger, an independent evidence witness, trusted timestamping, key-lifecycle management, encrypted role-based storage, and permissioned quorum anchoring. The witness retains commitments outside the server’s ledger before anchoring, allowing auditors to detect deletion, rewriting, filtering, or selective anchoring.

Anchoring notarizes evidence rather than controlling training. Detailed evidence stays encrypted off-chain, and only minimal round-level commitments are anchored. Our evaluation uses a permissioned four-validator, three-of-four signed-quorum simulation to test commitment verification, finality, consistency, and validator-fault behavior; it does not represent a production public-blockchain deployment. Model robustness and forensic accountability are distinct: a defense may reject a malicious update without retaining evidence that explains the incident, while evidence can remain verifiable even when detection is imperfect.

1.1. Contributions

1.

A forensic-ready FL architecture. Independently witnessed client commitments preserve evidence during the pre-anchor interval and define the framework’s detection and recovery boundaries.

2.

An evidence-preservation lifecycle. The lifecycle integrates Ed25519 signatures, hash-chained logging, witness receipts, trusted timestamping, monotonic ordering, key-lifecycle controls, AES-256-GCM encryption, role-based access control (RBAC), and permissioned quorum anchoring.

3.

Forensic quality and evidence-tampering metrics. We measure the Forensic Quality Index (FQI), Log Completeness Ratio (LCR), local and external Hash-Chain Integrity Rate (HCIR), Blockchain Consistency Score (BCS), Attribution Accuracy (AA), False Accusation Rate (FAR), Evidence Match Score (EMS), and Audit Retrieval Time (ART).

4.

Implementation and adversarial evaluation. We evaluate FL-Forensics on MNIST, Fashion-MNIST, and CIFAR-100 with 20 clients, Dirichlet non-IID data ($\alpha =0.5$), and three malicious clients. Detection F1 scores are 0.941, 0.800, and 0.521; corresponding FQI values are 0.956, 0.900, and 0.714.

2. Background and Related Work

FL clients train locally and send updates for server aggregation, reducing raw-data movement [18,23]. Differences in data, resources, availability, and trust create statistical heterogeneity, partial participation, and security challenges [6,15]. Secure aggregation protects updates during aggregation [7]; differentially private FL reduces information leakage [12]; and Byzantine-robust methods such as Krum and Trimmed Mean limit adversarial influence [5,34]. FLTrust uses a trusted server-side dataset to derive a reference update and assign client trust scores [9]. These mechanisms address privacy and robustness but do not provide a complete, independently verifiable record of update origins, server actions, and evidence tampering.

2.1. Federated Learning Foundations and Threats

At communication round t, the server distributes the global parameter vector ${\theta }^{\left(t\right)}$. Client i trains on its local dataset $D_i$ and returns parameters or a model delta, after which Federated Averaging (FedAvg) weights the client updates by local sample count to obtain the next global parameters ${\theta }^{(t+1)}$ [23]. Non-IID data can make benign updates statistically unusual [15]; our Dirichlet partition uses concentration parameter $\alpha =0.5$, where smaller $\alpha$ produces greater client-level class heterogeneity.

Clients may poison data, labels, or models [11]; implant model-replacement backdoors [2]; or expose private information through shared updates [14]. Differential privacy and secure aggregation reduce leakage [7,12], while Krum, Trimmed Mean, FLTrust, and FLTG mitigate Byzantine influence [5,9,32,34]. A compromised server can additionally suppress updates, alter aggregation or evidence, rewrite its chain, delay anchoring, or select records for commitment.

2.2. Robust Aggregation and External Accountability

Krum selects an update by neighbor distances [5]; Trimmed Mean removes coordinate-wise extremes [34]; FLTrust scores directional agreement with a clean root update [9]; and FLTG combines angle filtering, dynamic references, and non-IID-aware weighting [32]. High detection accuracy alone does not establish provenance, temporal ordering, evidence preservation, or incident reconstruction.

Distributed ledgers support FL transparency, coordination, provenance, and accountability [25]. Lo et al. [22] address accountability and fairness, while Goh et al. [13] use smart contracts to coordinate and verify training. External replication protects commitments but does not validate evidence before anchoring. FL-Forensics therefore uses a forensic anchoring layer rather than a sole evidence source or training control plane.

2.3. Related Frameworks

VeSAFL provides verifiable multi-server secure aggregation [8]; TrustFLow combines decentralized identities, credentials, provenance, influence estimation, and policy-driven revocation [26]; Blockchain-Audited FL separates blockchain provenance and update auditing [24]; and Atlas provides verifiable ML-lifecycle provenance and transparency [29]. Table 1 contrasts their primary scopes.

Seven gaps motivate the design: defenses prioritize confidentiality and robustness over evidence preservation; detection does not establish accountability; the server may be an untrusted custodian; anchoring cannot reveal prior omissions without a witness; attribution requires key-lifecycle and trusted-time management; evidence controls require adversarial tests; and forensic logs require privacy-compatible governance.

3. FL-Forensics Framework

FL-Forensics complements privacy, anomaly detection, and robust aggregation with signed commitments, independent pre-anchor witnessing, trusted ordering, tamper-evident and encrypted retention, controlled access, and round-level anchoring. The design follows forensic-readiness principles [27] and digital-evidence principles for identification, collection, acquisition, preservation, and integrity [16].

3.1. Design Goals and Trust Architecture

The goals are integrity, independent corroboration, attribution, temporal integrity, privacy, and recoverability. The architecture comprises client $C_i$, where i is the client index; a potentially compromised aggregation server S; an independent witness W; an identity and key registry A; a timestamp authority (TSA) T; anchor validator $V_j$, where j is the validator index; and an investigator or auditor I. In the prototype, the registry, witness, trusted-time service, and validator logic run in an isolated trust-service process separate from the Flower server. Production deployments should separate these functions administratively and protect keys using key management systems, hardware security modules, trusted platform modules, trusted execution environments, or comparable controls.

3.2. Threat Model and Guarantee Boundaries

Malicious clients may poison models, implant backdoors, amplify deltas, replay commitments, falsify metadata, or use invalid keys. A compromised server may suppress submissions, alter aggregation, delete or rewrite evidence, reorder or fabricate records, delay anchoring, or omit witnessed commitments. External adversaries may intercept, replay, replace, suppress, or delay messages. Validators may be unavailable or Byzantine within the quorum bound, but the primary guarantee requires a non-colluding witness.

The assumptions are that SHA-256 is collision-resistant; Ed25519 signatures are unforgeable when keys remain uncompromised; client keys remain outside server control; the witness receives each verified commitment before server acceptance; registry lifecycle information is trustworthy; the trusted-time source is protected; and, among four validators, at most one is Byzantine, so finalization requires three matching signatures.

Table 2. FL-Forensics threat model and forensic guarantee boundaries.

Threat	Detectability	Evidence and mechanism	Residual boundary
Pre-anchor modification	Detectable	Compare witness receipts with server evidence; recover the signed commitment, digest, sequence, and time.	Fails if the witness never receives the commitment or colludes.
Deletion or omission	Detectable	A witness receipt without a server record preserves origin and metadata.	Update bytes need separate retention.
Ledger rewriting	Detectable with witness	Compare local chain with witnessed commitments and order.	A rewritten chain can retain high Local HCIR.
Delayed/selective anchoring	Detectable	Compare expected witness rounds, receipt sets, Merkle roots, and finalized anchors.	Cannot force an anchor or create retrospective timeliness.
Forged signature	Detectable	Verify Ed25519 against the enrolled key and validity interval.	A stolen valid key is compromise, not forgery.
Timestamp manipulation	Detectable within time model	Verify signed time, skew, round, nonce, and sequence.	TSA compromise weakens absolute time.
Blocked witness path	Availability failure	Strict mode rejects submissions lacking a receipt.	Denial of service remains possible.
Poisoning/backdoor	Probabilistic	Multi-metric screening with signed, witnessed provenance.	Adaptive attacks may evade detection.

Table 2. FL-Forensics threat model and forensic guarantee boundaries.

Threat	Detectability	Evidence and mechanism	Residual boundary
Pre-anchor modification	Detectable	Compare witness receipts with server evidence; recover the signed commitment, digest, sequence, and time.	Fails if the witness never receives the commitment or colludes.
Deletion or omission	Detectable	A witness receipt without a server record preserves origin and metadata.	Update bytes need separate retention.
Ledger rewriting	Detectable with witness	Compare local chain with witnessed commitments and order.	A rewritten chain can retain high Local HCIR.
Delayed/selective anchoring	Detectable	Compare expected witness rounds, receipt sets, Merkle roots, and finalized anchors.	Cannot force an anchor or create retrospective timeliness.
Forged signature	Detectable	Verify Ed25519 against the enrolled key and validity interval.	A stolen valid key is compromise, not forgery.
Timestamp manipulation	Detectable within time model	Verify signed time, skew, round, nonce, and sequence.	TSA compromise weakens absolute time.
Blocked witness path	Availability failure	Strict mode rejects submissions lacking a receipt.	Denial of service remains possible.
Poisoning/backdoor	Probabilistic	Multi-metric screening with signed, witnessed provenance.	Adaptive attacks may evade detection.

FL-Forensics cannot prove omission if a commitment never reaches the witness; tolerate witness–server collusion; distinguish authorized use from misuse of a stolen key before revocation; prove arbitrary aggregation arithmetic; reconstruct unretained bytes from a digest; force an anchor; establish production-blockchain performance; or determine legal admissibility.

3.3. Evidence Lifecycle and Tamper-Evident Logging

FL-Forensics independently witnesses the canonical commitment $M_{i,t}$ for client $C_i$ in round t. The commitment contains experiment, round, and client identifiers; a model-update digest; a fresh nonce; privacy-minimized training-loss metadata; the model version; a sequence number; the client-claimed time; and the key identifier and version. The client deterministically serializes and signs the commitment:

$${\sigma }_{i,t}={\mathrm{Sign}}_{s{k}_{i,v}}\left(\mathrm{Canon}\left(M_{i,t}\right)\right),$$

(1)

where ${\sigma }_{i,t}$ is the resulting Ed25519 signature, $s{k}_{i,v}$ is client i’s private signing key at key version v, $\mathrm{Canon}(·)$ is the deterministic canonical-serialization function, and ${\mathrm{Sign}}_{sk}(·)$ is the signing operation under private key $sk$. Before server acceptance, the witness checks the key and validity interval, verifies the signature and temporal information, and returns an independent receipt. Each round’s receipts form a manifest represented by a Merkle root.

The server maintains a canonical hash-chained forensic ledger containing accepted updates, anomaly decisions, screening overrides, aggregation references, and signed summaries. To avoid confusing the ledger position with FL round t, let k index ledger entries. Each entry stores the preceding digest and computes

$$E_k.\mathrm{prev}\text{\_}\mathrm{hash}=h_{k-1},h_k=\mathrm{SHA256}\left(\mathrm{Canon}\left(E_k\right)\right).$$

(2)

Here, $E_k$ is the kth ledger entry, $E_k.\mathrm{prev}\text{\_}\mathrm{hash}$ is its stored predecessor field, $h_{k-1}$ is the digest of the preceding entry (or a fixed genesis value when $k=1$), and $h_k$ is the Secure Hash Algorithm 256-bit (SHA-256) digest of the canonical entry. The chain is tamper-evident, not immutable. A compromised server can rewrite entries and recompute subsequent hashes. Local HCIR therefore measures internal chain consistency, External HCIR measures agreement with witnessed evidence, and BCS measures agreement between finalized commitments and retained server and witness evidence.

3.4. Key Lifecycle, Trusted Time, and Secure Retention

Ed25519 signatures authenticate client commitments and server summaries. Verification uses an independently maintained registry containing identity, role, public key, key identifier/version, valid-from round, and any revocation or key-loss round. Rotation creates a new key version while preserving verification of earlier events. Revocation or reported loss closes the validity interval at an explicit round.

Let ${\tau }_{i,t}^c$ denote the client-claimed timestamp and ${\tau }_{i,t}^T$ the corresponding trusted timestamp in round t. The system checks

$$\left|{\tau }_{i,t}^c-{\tau }_{i,t}^T\right|\le {\Delta }_{\max },$$

(3)

where $|·|$ is the absolute time difference and ${\Delta }_{\max }$ is the maximum permitted clock skew, set to 5 seconds by default. Round identifiers and monotonic sequence numbers provide logical ordering and replay resistance. Production deployments should use an independently administered timestamp service.

The server ledger uses the Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode (AES-256-GCM) authenticated encryption with a fresh nonce per record. Exports provide public/minimized round data, pseudonymized auditor fields, authorized investigator evidence, or complete administrative access. All access decisions are logged. Training-loss metadata can be rounded or coarsened, and records outside a retention window are marked eligible for encrypted archival or cryptographic erasure. Detailed evidence remains off-chain.

3.5. External Permissioned Quorum Anchoring

Anchors notarize compact round-level forensic state; they do not coordinate training. After round t, the server signs a canonical summary $S_t$ containing observed witness receipts, receipts used for aggregation, documented exclusions, rejected-submission count, aggregation method, global-model digest, ledger tip, and server time. The minimized anchor commitment is

$$A_t=\left(H\left(\mathrm{experiment}\mathrm{id}\right),t,H\left(S_t\right),R_t^W,H\left(T_t\right),v_A\right),$$

(4)

where $A_t$ is the anchor tuple for round t; H denotes SHA-256; $H\left(\mathrm{experiment}\mathrm{id}\right)$ pseudonymously binds the experiment; $S_t$ is the signed server summary; $R_t^W$ is the Merkle root of witness W’s round-t manifest; $T_t$ is the trusted-time token; and $v_A$ is the anchor-schema version, distinct from signing-key version v. Hashing $S_t$ and $T_t$ keeps the anchor compact while binding their complete off-chain representations.

The backend is a permissioned signed-quorum simulation with four validator identities and a three-of-four finalization threshold. Only signatures over the same proposal count toward quorum. Tests cover validator unavailability, conflicting proposals, finality, reorganization attempts, and simulated congestion. The simulation does not measure production throughput, transaction fees, decentralization, or network finality.

3.6. Audit and Forensic-Aware Anomaly Profiling

Post-incident verification correlates server evidence, independent witness evidence, and the finalized external anchor. The investigator verifies ledger continuity and signatures, compares server records with witnessed commitments, and validates the server-summary digest, witness-manifest root, trusted-time-token digest, and validator quorum against the anchor. A valid witness receipt without a corresponding server entry indicates omission, deletion, or undocumented filtering. The witness preserves the signed commitment, identity binding, update digest, sequence, and trusted time, but not deleted update bytes unless those bytes are retained independently.

Statistical screening provides probabilistic evidence, not a cryptographic guarantee. The detector uses inverse cosine deviation from the mean update, Euclidean distance from the coordinate-wise median, and client training loss. It calculates median absolute deviation (MAD) thresholds and robust one-sided standardized scores, combines the strongest signals, and maintains a short persistence history. An update may evade detection while its signed history remains verifiable; conversely, a statistical flag alone does not prove malicious intent.

4. Implementation

FL-Forensics uses Flower’s Python client and strategy interfaces without modifying Flower [3]. It integrates submission, verification, screening, aggregation, evidence retention, and round finalization. Each NumPyClient trains locally, applies any configured attack or privacy transformation, computes a nonce-bound digest and commitment, signs it with Ed25519, obtains a witness receipt, and returns the model update and evidence references to the Flower server.

A custom Flower strategy rejects malformed commitments, inconsistent identifiers, models that do not match their digest, inconsistent minimized loss metadata, and missing or invalid witness receipts. For accepted updates, it retains the delta, identity, sample count, loss, receipt reference, and availability state. Supported aggregation modes are FedAvg, Screened FedAvg, Krum, Trimmed Mean, FLTrust, and FLTG. Screened FedAvg is used in the primary experiments. Figure 1 separates the client, trust-service, server, and anchor domains.

4.1. Data, Models, and Local Optimization

The implementation supports IID and Dirichlet non-IID partitioning; the primary experiments use $\alpha =0.5$. Class-wise proportions are resampled until each client has at least 32 samples. A clean, class-balanced root set of 500 samples is removed before partitioning and used by FLTrust and FLTG to compute reference updates.

The primary datasets are MNIST, Fashion-MNIST, and CIFAR-100. MNIST and Fashion-MNIST use a compact LeNet-inspired $1\to 6\to 16$ network, where the values denote successive input and convolutional-channel counts, with $5\times 5$ kernels, tanh activations, average pooling, 256- and 128-unit fully connected layers, and a dataset-specific classifier. CIFAR-100 uses a compact residual $3\to 32\to 64\to 128\to 256\to 100$ network, where the sequence denotes input channels, successive feature-channel widths, and the 100-class output, with batch normalization, rectified linear unit (ReLU) activations, max pooling, residual units, and adaptive average pooling. Clients use stochastic gradient descent (SGD) with momentum 0.9, Nesterov acceleration, and weight-decay coefficient $5\times {10}^{-4}$.

4.2. Attack Implementation

In the primary experiments, the malicious-client set $\mathcal{M}=\{3,5,8\}$ comprises 15% of the federation. Clients 3 and 5 flip labels, while client 8 performs a backdoor attack. Labels for selected examples with even class indices are changed according to

$$y^{\prime }=(y+1)\mathrm{mod}C.$$

(5)

Here, $y\in \{0,\dots ,C-1\}$ is the original label, $y^{\prime }$ is the poisoned label, C is the number of classes, and $\mathrm{mod}C$ wraps the incremented label into the valid class range. For the backdoor client, a $3\times 3$ trigger is placed in the bottom-right corner of selected images and labels are changed to class 0. Model replacement can amplify a malicious client’s delta:

$${\theta }_i^{\mathrm{out}}={\theta }^{\left(t\right)}+\gamma \left({\theta }_i^{\mathrm{local}}-{\theta }^{\left(t\right)}\right),$$

(6)

where ${\theta }_i^{\mathrm{local}}$ is client i’s locally trained parameter vector, ${\theta }_i^{\mathrm{out}}$ is the vector submitted by that client, and $\gamma$ is the model-replacement amplification factor. Thus, $\gamma =1$ submits the local model unchanged, while $\gamma >1$ amplifies its displacement from the round-t global model ${\theta }^{\left(t\right)}$.

4.3. Client Verification and Anomaly Detection

The trust service checks the enrolled key and validity interval, verifies the commitment signature and temporal information, and issues a witness receipt. The server rehashes the model with the nonce and verifies the round, identity, loss metadata, receipt validity, exact commitment binding, and equality of the witnessed and submitted signatures. Submissions that fail any check are rejected, and the failures are recorded.

Let ${\mathcal{I}}_t$ be the set of cryptographically valid clients in round t, let $K_t=\left|{\mathcal{I}}_t\right|$ be its size, and let ${\Delta }_i^{\left(t\right)}={\theta }_i^{\mathrm{out}}-{\theta }^{\left(t\right)}$ be client i’s flattened parameter delta. The mean valid-client delta is

$${\overline{\Delta }}^{\left(t\right)}={\displaystyle \frac{1}{K_t}}\sum _{j\in {\mathcal{I}}_t}{\Delta }_j^{\left(t\right)}.$$

(7)

The primary detector uses inverse cosine deviation,

$$m_{i,\cos }^{\left(t\right)}=1-{\displaystyle \frac{〈{\Delta }_i^{\left(t\right)},{\overline{\Delta }}^{\left(t\right)}〉}{{\parallel {\Delta }_i^{\left(t\right)}\parallel }_2{\parallel {\overline{\Delta }}^{\left(t\right)}\parallel }_2+ϵ}},$$

(8)

where $\langle ·,·\rangle$ is the Euclidean inner product, ${\parallel ·\parallel }_2$ is the Euclidean norm, and the small constant $ϵ>0$ prevents division by zero. Larger $m_{i,\cos }^{\left(t\right)}$ indicates weaker directional agreement with the round mean. The second signal is distance from the coordinate-wise median,

$$m_{i,\mathrm{dist}}^{\left(t\right)}={∥{\Delta }_i^{\left(t\right)}-{\mathrm{coordmedian}}_{j\in {\mathcal{I}}_t}\left({\Delta }_j^{\left(t\right)}\right)∥}_2,$$

(9)

where coordmedian takes the median independently in every parameter coordinate. The third signal is client training loss, $m_{i,\mathrm{loss}}^{\left(t\right)}={\ell }_i^{\left(t\right)}$, where ${\ell }_i^{\left(t\right)}$ is client i’s reported loss in round t. For each metric label $a\in \{\cos ,\mathrm{dist},\mathrm{loss}\}$, define

$${\tilde{m}}_a^{\left(t\right)}={\mathrm{median}}_{j\in {\mathcal{I}}_t}{m}_{j,a}^{\left(t\right)},{\mathrm{MAD}}_a^{\left(t\right)}={\mathrm{median}}_{j\in {\mathcal{I}}_t}\left|m_{j,a}^{\left(t\right)}-{\tilde{m}}_a^{\left(t\right)}\right|,$$

(10)

$${\tau }_a^{\left(t\right)}={\tilde{m}}_a^{\left(t\right)}+\lambda {\mathrm{MAD}}_a^{\left(t\right)},z_{i,a}^{\left(t\right)}=\max \left(0,{\displaystyle \frac{m_{i,a}^{\left(t\right)}-{\tilde{m}}_a^{\left(t\right)}}{1.4826{\mathrm{MAD}}_a^{\left(t\right)}+ϵ}}\right).$$

(11)

A client is flagged by multi-signal voting, a sufficiently large aggregate score, or persistent moderate anomalies. Here, ${\tilde{m}}_a^{\left(t\right)}$ is metric a’s round median, ${\mathrm{MAD}}_a^{\left(t\right)}$ is its median absolute deviation, ${\tau }_a^{\left(t\right)}$ is its outlier threshold, $\lambda$ controls threshold strictness, and $z_{i,a}^{\left(t\right)}$ is a nonnegative one-sided robust standardized score; the factor 1.4826 makes MAD comparable to standard deviation under normally distributed observations. The implementation defaults are $\lambda =2.5$; minimum vote count $V_{min}=2$; aggregate-score threshold ${\tau }_s=3.5$; persistent-moderate-score threshold ${\tau }_p=2.0$; and persistence window $P=2$ consecutive rounds.

With Screened FedAvg, flagged updates are removed before weighted averaging:

$${\Delta }^{\left(t\right)}={\displaystyle \frac{{\sum }_{i\in H_t}{n}_i{\Delta }_i^{\left(t\right)}}{{\sum }_{i\in H_t}{n}_i}}.$$

(12)

Here, $H_t\subseteq {\mathcal{I}}_t$ is the set of valid clients not flagged in round t, $n_i$ is client i’s local sample count, and ${\Delta }^{\left(t\right)}$ is the sample-weighted aggregate delta applied to the global model. If too few updates remain, aggregation uses all cryptographically valid submissions and records a SCREENING_OVERRIDE event.

4.4. Evidence Outputs and Boundaries

Each run produces ledgers, witness receipts and manifests, Merkle roots, signed summaries, anchor and finality records, detector diagnostics, participation and attribution summaries, forensic metrics, access and privacy audits, consensus-fault results, ablations, and evidence-tampering results. Six limits apply: trust services are isolated but not independently administered; anchoring is simulated; receipts preserve commitments rather than update bytes; measuring forensic cost overhead requires matched enabled and disabled runs; aggregation arithmetic is not cryptographically proved; and anomaly detection remains probabilistic.

5. Experimental Evaluation

We evaluate model utility, attack mitigation, malicious-client detection, and forensic readiness under controlled evidence manipulation. The research questions concern model utility and attack success; detector performance relative to robust FL baselines; evidence integrity, attribution, availability, and auditability; the contribution of individual forensic controls; and operational limits such as retrieval latency and end-to-end overhead.

5.1. Experimental Setup

The primary evaluation uses MNIST, Fashion-MNIST, and CIFAR-100 with all 20 clients participating each round under a Dirichlet non-IID partition ($\alpha =0.5$). Clients $\{3,5,8\}$ are malicious: clients 3 and 5 flip labels, and client 8 performs a trigger-based backdoor attack. The primary aggregation strategy is Screened FedAvg. MNIST and Fashion-MNIST run for 20 rounds with two local epochs per round; CIFAR-100 runs for 30 rounds with four local epochs. Figure 2 summarizes the configuration.

The experiments enable Ed25519-signed commitments, independent witness receipts, signed trusted-time evidence, encrypted hash-chained storage, and permissioned quorum anchoring. Detector and forensic measurements use the client updates and evidence produced by the corresponding Flower run.

5.2. Evaluation Metrics

We separate model, detection, and forensic metrics because attack detection does not establish evidence availability. Classification accuracy and the backdoor attack success rate (ASR) are

$$\mathrm{Accuracy}={\displaystyle \frac{N_{\mathrm{correct}}}{N_{\mathrm{test}}}},\mathrm{ASR}={\displaystyle \frac{N_{\mathrm{target}}}{N_{\mathrm{eligible}\mathrm{triggered}}}}.$$

(13)

Here, $N_{\mathrm{correct}}$ is the number of clean test examples classified correctly, and $N_{\mathrm{test}}$ is the total number of clean test examples. For ASR, $N_{\mathrm{eligible}\mathrm{triggered}}$ is the number of triggered test examples whose original label is not already the attacker’s target class, and $N_{\mathrm{target}}$ is the number of those examples that the attacked model predicts as the target class. Thus, higher accuracy indicates better clean-data utility, whereas lower ASR indicates stronger resistance to the backdoor attack.

Detection precision, recall, and the F1 score are

$$\mathrm{Precision}={\displaystyle \frac{TP}{TP+FP}},\mathrm{Recall}={\displaystyle \frac{TP}{TP+FN}},F_1={\displaystyle \frac{2\mathrm{Precision}\mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}.$$

(14)

$TP$ (true positives) counts malicious client-round observations correctly flagged by the detector; $FP$ (false positives) counts benign client-round observations incorrectly flagged; and $FN$ (false negatives) counts malicious client-round observations that the detector misses. Precision is the fraction of flags that are correct, recall is the fraction of malicious observations detected, and $F_1$ is their harmonic mean. True negatives ($TN$), used in the confusion-outcome analysis, are benign client-round observations correctly left unflagged.

Forensic metrics are

$$\mathrm{LCR}={\displaystyle \frac{N_{\mathrm{observed}}}{N_{\mathrm{expected}}}},{\mathrm{HCIR}}_{\mathrm{local}}={\displaystyle \frac{N_{\mathrm{valid}\mathrm{local}\mathrm{entries}}}{N_{\mathrm{ledger}\mathrm{entries}}}},$$

(15)

$N_{\mathrm{expected}}$ is the number of forensic records that the protocol should produce, and $N_{\mathrm{observed}}$ is the number actually retained, so LCR measures evidence completeness. $N_{\mathrm{ledger}\mathrm{entries}}$ is the total number of entries in the server ledger, and $N_{\mathrm{valid}\mathrm{local}\mathrm{entries}}$ is the number whose stored hashes and predecessor links verify within that ledger. Consequently, ${\mathrm{HCIR}}_{\mathrm{local}}$ measures internal hash-chain consistency, but it cannot by itself reveal a complete server-side rewrite followed by rehashing.

$${\mathrm{HCIR}}_{\mathrm{external}}={\displaystyle \frac{N_{\mathrm{externally}\mathrm{consistent}}}{N_{\mathrm{witnessed}\mathrm{evidence}}}},\mathrm{BCS}={\displaystyle \frac{N_{\mathrm{valid}\mathrm{anchor}\mathrm{comparisons}}}{N_{\mathrm{anchor}\mathrm{comparisons}}}},$$

(16)

$N_{\mathrm{witnessed}\mathrm{evidence}}$ is the number of evidence items represented by independently retained witness receipts and manifests, and $N_{\mathrm{externally}\mathrm{consistent}}$ is the number that agree with the corresponding server records. Therefore, ${\mathrm{HCIR}}_{\mathrm{external}}$ measures cross-domain consistency rather than only local chain validity. $N_{\mathrm{anchor}\mathrm{comparisons}}$ is the number of finalized anchor checks performed, and $N_{\mathrm{valid}\mathrm{anchor}\mathrm{comparisons}}$ is the number for which the retained server summary, witness-manifest root, trusted-time digest, and validator quorum agree with the finalized commitment. BCS is the resulting Blockchain Consistency Score.

$$\mathrm{AA}={\displaystyle \frac{N_{\mathrm{correctly}\mathrm{attributed}\mathrm{attackers}}}{N_{\mathrm{true}\mathrm{attackers}}}},\mathrm{FAR}={\displaystyle \frac{N_{\mathrm{falsely}\mathrm{accused}\mathrm{benign}\mathrm{clients}}}{N_{\mathrm{benign}\mathrm{clients}}}},$$

(17)

$N_{\mathrm{true}\mathrm{attackers}}$ is the number of ground-truth malicious clients, and $N_{\mathrm{correctly}\mathrm{attributed}\mathrm{attackers}}$ is the number correctly linked to their signed and witnessed malicious activity; their ratio is Attribution Accuracy (AA). $N_{\mathrm{benign}\mathrm{clients}}$ is the number of ground-truth benign clients, while $N_{\mathrm{falsely}\mathrm{accused}\mathrm{benign}\mathrm{clients}}$ is the number incorrectly attributed as malicious; their ratio is the False Accusation Rate (FAR).

$$\mathrm{EMS}=\mathrm{AA}(1-\mathrm{FAR}),\mathrm{ART}={\displaystyle \frac{1}{Q}}{\displaystyle \sum _{q=1}^Q}{T}_q.$$

(18)

The Evidence Match Score (EMS) rewards correct attribution through AA while penalizing false accusations through $1-\mathrm{FAR}$. For Audit Retrieval Time (ART), Q is the number of audit retrieval queries and $T_q$ is the elapsed local retrieval time for query q; ART is their arithmetic mean. ART does not include signing, witness communication, consensus finality, or network delay.

Let $N_{\mathrm{available}\mathrm{artifacts}}$ be the number of expected evidence artifacts that remain retrievable and verifiable at audit time, and let $N_{\mathrm{expected}\mathrm{artifacts}}$ be the number required by the protocol. The Evidence Availability Score is

$$\mathrm{EAS}={\displaystyle \frac{N_{\mathrm{available}\mathrm{artifacts}}}{N_{\mathrm{expected}\mathrm{artifacts}}}}.$$

(19)

The Forensic Quality Index is

$$\mathrm{FQI}=0.25\left({\displaystyle \frac{\mathrm{EAS}+{\mathrm{HCIR}}_{\mathrm{external}}+\mathrm{BCS}}{3}}\right)+0.25\left({\displaystyle \frac{\mathrm{AA}+(1-\mathrm{FAR})}{2}}\right)+0.50F_1.$$

(20)

The composite uses External HCIR because independent corroboration is required under the compromised-server threat model; the reported primary runs have identical Local and External HCIR values. BCS, AA, FAR, and $F_1$ are defined above. The coefficients assign 25% of FQI to the mean evidence-quality component (EAS, External HCIR, and BCS), 25% to the mean attribution component (AA and the benign-client protection term $1-\mathrm{FAR}$), and 50% to malicious-client detection $F_1$. All component scores range from 0 to 1, so FQI also ranges from 0 to 1; higher values indicate stronger forensic readiness. FQI is not a measure of model accuracy.

5.3. Model Utility and Attack Performance

Figure 3 reports clean accuracy, backdoor ASR, and detection precision, recall, and F1.

MNIST achieves 96.46% accuracy and 0.24% ASR. Its precision, recall, and F1 are 0.949, 0.933, and 0.941. Fashion-MNIST achieves 79.06% accuracy and 4.62% ASR, with corresponding detection scores of 1.000, 0.667, and 0.800. CIFAR-100 achieves 58.53% accuracy and 1.46% ASR, with scores of 0.516, 0.525, and 0.521, reflecting the difficulty of separating attacks from benign variation in a 100-class non-IID task. Low attack success does not imply perfect attacker identification, and imperfect detection does not imply missing or corrupted evidence.

5.4. Detection Performance and Baseline Comparison

Krum, Trimmed Mean, FLTrust, FLTG-based filtering, and FL-Forensics are compared using the same retained client deltas. On MNIST, FL-Forensics obtains precision of 0.949, recall of 0.933, and F1 of 0.941; the F1 values are 0.874 for Krum, 0.944 for Trimmed Mean, 0.170 for FLTrust, and 0.238 for FLTG-based filtering. Trimmed Mean is slightly higher on this measure, so we do not claim universal detector superiority; FL-Forensics additionally preserves signed, witnessed, time-bound, encrypted, and externally committed evidence. Figure 4 shows client-round outcomes.

Krum and Trimmed Mean identify many malicious client-round observations but differ in their false-positive rates; FLTrust and FLTG show weaker true-positive/false-negative trade-offs. FL-Forensics combines high coverage with comparatively few false positives.

5.5. Forensic Integrity, Attribution, and Auditability

Figure 5 summarizes completeness, local and witnessed consistency, anchor consistency, attribution, evidence matching, and retrieval latency.

LCR, Local HCIR, External HCIR, and BCS are 1.000 for all datasets. AA is 1.000, 1.000, and 0.750; FAR is 0.118, 0.000, and 0.125; and EMS is 0.882, 1.000, and 0.656 for MNIST, Fashion-MNIST, and CIFAR-100, respectively. Mean ART is 0.044, 0.027, and 0.059 ms. ART measures local retrieval, not quorum finality, network latency, or total forensic overhead.

5.6. Forensic Quality Index and Component Ablation

Figure 6 reports FQI by dataset. FQI is 0.956 for MNIST, 0.900 for Fashion-MNIST, and 0.714 for CIFAR-100. The decreases reflect detection and attribution difficulty, while LCR, Local HCIR, External HCIR, and BCS remain 1.000.

The counterfactual ablation removes selected controls from the same captured evidence scenario without retraining the model. Figure 7 reports tampering detection, recovery, attribution, F1, FQI, and privacy-control coverage.

The complete configuration achieves 100% tampering detection, recovery, and attribution, with an F1 of 94.7%. Without the witness, recovery falls to 12.5% and attribution to 22.2%. Removing signatures weakens origin attribution; removing anchoring weakens long-term external consistency; removing trusted time weakens temporal verification; and removing encryption/RBAC reduces privacy-control coverage to zero. The local-only profile confirms that a server hash chain is insufficient under server compromise.

5.7. Evidence-Tampering and Runtime Evaluation

The campaign covers record deletion, ledger rewriting, reordering, duplication, signature substitution, cross-round replay, fabricated entries, timestamp and server-summary manipulation, and delayed or selective anchoring. A compromised server can alter a historical entry and rebuild the remaining hash chain, leaving Local HCIR high; External HCIR exposes the discrepancy relative to the witness receipts. For each manipulation, detection, recovery, and technical attribution are recorded separately.

ART is below 0.1 ms in all experiments but excludes commitment generation, signing, witness submission, encrypted persistence, anomaly processing, trusted time, anchoring, and network delay. End-to-end Forensic Cost Overhead requires matched enabled and disabled runs:

$$\mathrm{FCO}={\displaystyle \frac{T_{\mathrm{forensic}}-T_{\mathrm{baseline}}}{T_{\mathrm{baseline}}}}.$$

(21)

Here, $T_{\mathrm{forensic}}$ is the end-to-end runtime with forensic controls enabled and $T_{\mathrm{baseline}}$ is the runtime of the otherwise matched control run; FCO is their dimensionless relative overhead. Without a matched forensic-disabled run, FCO is not available and is not inferred from ART.

6. Discussion

The model results show that utility, attack mitigation, and malicious-client detection should be evaluated separately. MNIST combines 96.46% clean accuracy with 0.24% ASR and an F1 of 0.941. Fashion-MNIST has lower clean accuracy (79.06%) and a higher ASR (4.62%); its precision of 1.000 indicates that every flag in this run was correct, but its recall of 0.667 shows that some malicious client-round observations were missed. CIFAR-100 has the lowest clean accuracy (58.53%) and detection F1 (0.521), although its ASR remains 1.46%. These results show that low backdoor success does not imply complete identification of malicious clients.

The MNIST baseline comparison places the detector’s performance in context. FL-Forensics reaches an F1 of 0.941, compared with 0.874 for Krum, 0.944 for Trimmed Mean, 0.170 for FLTrust, and 0.238 for FLTG-based filtering. Trimmed Mean is slightly higher on this detection measure, so the results do not establish universal statistical superiority for FL-Forensics. The distinction is functional: FL-Forensics combines competitive detection with signed, witnessed, time-bound, encrypted, and externally anchored evidence that the detection baselines do not provide as part of this comparison.

The forensic results remain stable even when detection becomes more difficult. LCR, Local HCIR, External HCIR, and BCS are 1.000 for all three datasets, whereas detection F1 decreases from 0.941 on MNIST to 0.800 on Fashion-MNIST and 0.521 on CIFAR-100. This separation is important because it shows that complete, internally consistent, independently corroborated, and anchor-consistent evidence can be retained without assuming perfect anomaly detection. Local HCIR alone would not be sufficient under server compromise because a server can rewrite and rehash its ledger; the External HCIR result supplies the independent comparison with witness evidence.

Attribution quality varies across datasets. AA is 1.000 for MNIST and Fashion-MNIST but decreases to 0.750 for CIFAR-100. FAR is 0.118, 0.000, and 0.125, producing EMS values of 0.882, 1.000, and 0.656, respectively. The Fashion-MNIST results illustrate that attribution and statistical detection capture different properties: attribution remains complete with no false accusations even though detector recall is 0.667. For CIFAR-100, weaker detection and attribution reduce FQI to 0.714, while the evidence-integrity measures remain unchanged. Similarly, the FQI decrease from 0.956 on MNIST to 0.900 on Fashion-MNIST reflects lower detection performance rather than evidence loss or anchor inconsistency.

The ablation and evidence-tampering results explain why the framework uses multiple evidence channels. The complete configuration achieves 100% tampering detection, recovery, and attribution in the evaluated scenario. Removing the witness reduces recovery to 12.5% and attribution to 22.2%, showing that a locally consistent server ledger cannot provide equivalent recovery after server-side manipulation. Signatures contribute origin binding, trusted time contributes temporal verification, anchoring contributes long-term external consistency, and encryption/RBAC contributes privacy-control coverage. The tampering campaign further shows that External HCIR can reveal a rewritten and rehashed ledger whose Local HCIR remains high. Anchoring can verify a committed state, but independent witness evidence is required to expose deletion or selective processing before commitment.

The reported ART values of 0.044, 0.027, and 0.059 ms show that retained evidence can be retrieved locally with sub-millisecond latency in these experiments. They do not measure the full operational cost of signing, witness communication, encrypted storage, trusted time, quorum finalization, or network delay. Consequently, the results support efficient local audit retrieval but do not support a claim of negligible end-to-end overhead; FCO remains unavailable without matched forensic-enabled and forensic-disabled runs.

The interpretation is bounded by the controlled 20-client evaluation, probabilistic detection under non-IID data, and the simulated four-validator quorum backend. The trust services are isolated from the Flower server but are not independently administered, and witness receipts preserve commitments rather than deleted update bytes. The framework also does not prove arbitrary aggregation arithmetic or establish legal admissibility. Within these limits, the results support the central claim that forensic accountability complements, rather than replaces, robust aggregation and anomaly detection.

7. Conclusions

FL-Forensics provides an evidence-preservation and accountability layer for federated learning in the presence of malicious clients and a potentially compromised aggregation server. The framework combines signed client commitments, independent pre-anchor witness receipts, trusted timestamps and sequence information, key-lifecycle controls, encrypted hash-chained storage, role-based access control, and permissioned quorum anchoring. These mechanisms retain detailed evidence off-chain while committing compact round-level state for independent verification.

The Flower implementation was evaluated with 20 clients, Dirichlet non-IID data, and three malicious clients on MNIST, Fashion-MNIST, and CIFAR-100. Detection F1 scores were 0.941, 0.800, and 0.521, while FQI values were 0.956, 0.900, and 0.714, respectively. The variation across these datasets indicates that malicious-client detection becomes more difficult as benign update variation increases. The MNIST comparison also shows that FL-Forensics is competitive with Krum and Trimmed Mean while providing evidence functions beyond statistical filtering.

Evidence integrity remained stable across the three evaluations: LCR, Local HCIR, External HCIR, and BCS were all 1.000. Attribution performance varied, with AA values of 1.000, 1.000, and 0.750 and EMS values of 0.882, 1.000, and 0.656. These results demonstrate that evidence completeness and independent verifiability can remain strong even when detection and attribution are imperfect. The ablation results further identify distinct roles for each control. In particular, removing the witness reduced recovery to 12.5% and attribution to 22.2%, while signatures, trusted time, anchoring, and encrypted RBAC retention supported origin verification, temporal ordering, external consistency, and privacy protection.

The evidence-tampering evaluation shows why local hash-chain validation is insufficient by itself: a compromised server can rewrite and rehash its ledger while independent witness evidence still exposes the inconsistency. Local audit retrieval remained below 0.1 ms, but this measurement does not represent end-to-end forensic overhead, which requires matched forensic-enabled and forensic-disabled runs. Overall, the results support FL-Forensics as a complement to robust aggregation and anomaly detection: it does not guarantee perfect attack detection or prove aggregation correctness, but it preserves attributable and independently corroborated evidence for post-incident investigation within the stated trust and deployment boundaries.

8. Future Work

Future work will study larger, longer-lived cross-silo federations with partial participation and diverse models; adaptive and collusive adversaries; independently administered witness, registry, time, and validator services; stronger metadata minimization and privacy-preserving provenance; matched overhead measurements; production permissioned anchoring; and verifiable computation for aggregation correctness.