Final-year major project · VTU · Dept. of CS&D

EveFL

A federated learning system where quantum physics detects eavesdroppers on the training channel, not just encrypts it.

Multi-hospital chest X-ray classification, secured by BB84 key exchange and a live quantum bit error rate signal that decides how much the server trusts each round.

Open the live simulator ↓
01 — The problem, in plain language

Training on data you are never allowed to see

Hospitals want to train a shared AI model without sharing patient data. Federated learning already solves that: each hospital trains on its own images and only sends model updates.

But those updates can still be intercepted, or faked. EveFL adds a layer that can tell when someone's listening in — using quantum physics — and reacts automatically, tightening or halting the round instead of carrying on regardless.

02 — Interactive pipeline simulator

One full EveFL round, stage by stage

Set an eavesdropper intercept rate, run the round, and watch each stage report what happened, the exact values it produced, and why the step exists. Switch between beginner and technical wording at any time.

0%
0% — nobody listening100% — every qubit intercepted
Set an intercept rate and press Run Round to simulate one full EveFL training round, stage by stage.
03 — Threat model

What EveFL actually defends against

Implemented

Eavesdropping on the key exchange

Someone quietly taps the channel the hospitals use to agree on a secret key.

BB84 quantum key exchange + live QBER monitoring

Implemented / partly planned

Gradient leakage

An attacker steals model updates and reconstructs a patient's chest X-ray from them.

AES-256-GCM encryption of every update (CKKS homomorphic encryption planned, so even the server never sees raw gradients)

Partly planned

Malicious or compromised hospital

A participant sends deliberately poisoned updates to corrupt the shared model.

Anomaly filtering under CAUTION; Groth16 zk-SNARK proof of honest training (planned)

Out of scope, stated plainly: EveFL is not designed to stop brute-force key cracking or denial-of-service attacks. Those are separate, largely already-solved problems, handled by using standard well-vetted cryptography (AES-256, CRYSTALS-Kyber) — not something EveFL contributes to.

04 — Architecture

How the pieces fit together

Click any component to read what it does.

Runs the quantum key exchange per round, sifts bases, estimates QBER from a public sample, and classifies the channel as SECURE, CAUTION or LOCKDOWN. This classification is what drives the rest of the round.
05 — Algorithms, by role

Security mechanisms vs. ML plumbing

Kept deliberately separate so it is obvious which algorithms defend the system and which simply make the learning work.

Security algorithms

  • BB84Implemented

    Quantum key distribution over the training channel

  • QBER estimationImplemented

    Channel-disturbance measurement from sifted-bit sampling

  • 3-state FSMImplemented

    SECURE / CAUTION / LOCKDOWN orchestration

  • HKDF-SHA256Implemented

    Key derivation from punctured sifted key material

  • AES-256-GCMImplemented

    Authenticated encryption of client updates

  • CRYSTALS-KyberPlanned

    Post-quantum classical fallback key exchange

  • CKKSPlanned

    Homomorphic aggregation over encrypted gradients

  • Groth16 zk-SNARKPlanned

    Proof that a client trained honestly

ML / infrastructure algorithms

  • FedAvg / FedProx

    Aggregation strategies, selected by security state

  • ResNet-18

    Local classifier for chest X-ray images

  • Dirichlet(α = 0.5)

    Non-IID data partitioning across the 3 hospitals

  • NSGA-II

    Offline threshold tuning — optimises the system, defends against nothing itself

06 — Validation

Simulated QBER vs. theory

Across intercept rates α = 0 to 1, the simulated quantum bit error rate tracks the BB84 intercept-resend prediction of 0.25·α. Bands behind the curve show where each security state takes over.

simulated QBER theory 0.25·α secure band caution band lockdown band
07 — Novelty

How this differs from prior work

  1. 01

    QBER as a first-class orchestration signal

    Existing systems use quantum key distribution only to produce an encryption key. In EveFL the error rate itself is a control input that decides the aggregation strategy for the round.

  2. 02

    Graduated 3-state response, not binary pause/resume

    QKDFL, the closest existing system, halts training when the channel looks bad and resumes when it looks fine. EveFL adds a CAUTION state that keeps training while down-weighting suspicious updates, so mild noise does not cost a whole round.

  3. 03

    Accuracy-vs-security Pareto tradeoff

    Thresholds are tuned offline with NSGA-II against both model accuracy and security exposure, producing an explicit tradeoff curve rather than a single hand-picked setting.

08 — Limitations

Known limitations, stated honestly

  • The classical channel used to compare QBER samples is not yet authenticated, so a man-in-the-middle on that channel is currently out of the model.
  • Error correction (e.g. Cascade) and privacy amplification are on the roadmap, not yet implemented — the derived key is illustrative rather than production-grade.
  • Thresholds are static, so honest channel noise near 5% can trigger CAUTION: a real false-positive risk that adaptive thresholds would reduce.