Ripple: Private Collaborative Learning against Model Poisoning via Zero-Knowledge Proofs for Non-linear Functions

Private collaborative learning allows a model owner to train neural networks using data from distributed data owners, while preserving both data and model privacy. Recent frameworks achieve this by leveraging secure multiparty computation (MPC) to enable private training across multiple parties. However, existing approaches assume semi-honest data owners and fail to defend against model poisoning attacks, where malicious data owners can inject forged updates to degrade model performance. In this paper, we propose Ripple, a private collaborative learning framework that defends against model poisoning attacks via zero-knowledge proofs for non-linear functions. We reduce multi-party collaborative learning to a two-party computation paradigm between the model owner and each data owner. To ensure both the verifiability and privacy of inputs to non-linear functions, we design secure protocols that integrate removable noise mechanisms with Paillier-based zero-knowledge proofs. These protocols allow the model owner to verify the correctness of data owners' computations without gaining access to their private inputs. Our theoretical analysis provides the security guarantees of Ripple, and empirical evaluations demonstrate its ability to defend against model poisoning attacks. Specifically, under the Min-Max attack with non-IID data, existing methods suffer from accuracy degradation of up to 59%, whereas Ripple consistently limits the degradation to within 4%. Moreover, the accuracy of the model is not affected by the data distribution or the proportion of malicious data owners.