{'fraction_non_alphanumeric': 0.03397177990593302, 'fraction_numerical': 0.009406698022326741, 'mean_word_length': 4.861009631351711, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
CFL: Cluster Federated Learning in Large-scale Peer-to-Peer Networks

Federated learning (FL) has sparked extensive interest in exploiting the private data on clients' local devices. However, the parameter server setting of FL not only has high bandwidth requirements, but also poses data privacy issues and a single point of failure. In this paper, we propose an efficient and privacy-preserving protocol, dubbed CFL, which is the first fine-grained global model training for FL in large-scale peer-to-peer (P2P) networks. Unlike previous FL in P2P networks, CFL aggregates local model update parameters hierarchically, which improves the communication efficiency facing large amounts of clients. Also, the aggregation in CFL is performed in a secure manner by introducing the authenticated encryption scheme, whose key is established through a random pairwise key scheme enhanced by a proposed voting-based key revocation mechanism. Rigorous analyses show that CFL guarantees the privacy and data integrity and authenticity of local model update parameters under two widespread threat models. More importantly, the proposed key revocation mechanism can effectively resist hijack attacks, thereby ensuring the confidentiality of the communication keys. Ingenious experiments on the Trec06p and Trec07 datasets show that the global model trained by CFL has good classification accuracy, model generalization, and rapid convergence rate, and the dropout-robustness of the system is achieved. Compared to the first global model training protocol for FL in P2P networks, PPT, CFL improves communication efficiency by 43.25%. Also, CFL outperforms PPT in terms of computational efficiency.

expand the system model of PPT [9], where clients and a server loosely connected to a few of them are distributed in a P2P network, by involving large amounts of clients. To improve the communication efficiency of the system, CFL aggregates local model update parameters hierarchically, rather than directly aggregates all local contributions like PPT. Instead of leveraging the digital signature scheme, CFL guarantees security and computation efficiency through the authenticated encryption scheme, whose key is established by a random pairwise keys scheme enhanced by a proposed key revocation mechanism which improves the security against hijacking attacks [16].
The main contributions are as follows: A global model training protocol for FL in large-scale P2P networks. We propose a fine-grained global model training protocol for FL in large-scale P2P networks which comprises a Secure Communication Key Establishment Protocol and an Inner-Cluster Model Aggregation Protocol. Compared to the PPT protocol, larger amounts of clients could train the global model in a higher communication and computation efficient manner with the deployment of the proposed CFL protocol. A secure and privacy-preserving protocol. We analyze the security and privacy ability CFL achieves under the widespread internal semi-honest participants and external malicious adversaries threat models [4,5,9]. In detail, the proposed CFL protocol can protect the privacy of the client's individual local contributions by a random noise, which is generated initially and eliminated ultimately. Besides, CFL guarantees the data integrity and authenticity of local contributions by leveraging the authenticated encryption scheme. Particularly, rigorous analyses show that CFL can guarantee the confidentiality of the communication key against hijacking attacks [16]. In addition, we analyze the network connectivity and formally give the threshold of the key ring size, which proves that the proposed CFL protocol can guarantee secure transmission. Experimental evaluation. We conduct experiments on the Trec06p and Trec07 datasets, which demonstrate that the proposed CFL protocol can ensure classification accuracy, model generalization, and rapid convergence rate of the global model. Also, the dropout-robustness of the system is achieved by CFL. More importantly, CFL improves communication efficiency by 43.25% and computational efficiency by 0.87% compared to PPT [9].
The rest of the paper is organized as follows. Section 2 reviews related works. In Section 3, we formalize the system model, security requirements, and design goal. Section 4 formally describes some preliminaries. Section 5 devises the proposed CFL protocol followed by security analysis, network connectivity analysis, and experiments in Sections 6 and7. We conclude this paper in Section 8.

Related Works
Existing decentralized FL works mainly focus on algorithms and frameworks. As for the algorithm, Baidu [13] proposed a bandwidth optimization algorithm, Ring AllReduce, which averages the gradient effectively on distributed devices. Yang et al. [31] exploited the signal superposition property of wireless multiple-access channels to locally computing updates in FL by the over-the-air computation. Combining the PushSum gossip algorithm with stochastic gradient updates, Assran et al. [1] proposed SGP and OSGP to accelerate distributed training of deep neural networks. As for the framework, Ramanan et al. [25] proposed a blockchain-based aggregator-free FL framework, BAFFLE, which achieves high scalability and computational efficiency in a private Ethereum network. Hu et al. [15] addressed the decentralized FL problem by aggregating the local model segments based on the gossip protocol. Dubey et al. [11] devised FEDUCB for FL in P2P networks to solve the contextual linear bandit problem. Li et al. [19] proposed SimFL to build decision trees with bounded errors, which leverages locality-sensitive hashing to collect similarity information. However, the above works propose advanced decentralized FL frameworks or algorithms in a coarsegrained manner. A formal description of decentralized FL settings and a general and fine-grained model training protocol that can guide model training for FL in P2P networks in practice are still absent.
Recently, Chen et al. [9] formalized the FL settings in P2P networks and proposed a fine-grained model training protocol, PPT, which aggregates clients' local contributions in a privacy-preserving manner. However, the PPT protocol is inefficient facing a large number of clients, i.e., FL in large-scale P2P networks. Besides, the communication key establishment phase in PPT is vulnerable to hijacking attacks [16], which might give rise to a security risk to the system.
To meet the efficiency requirement of FL in large-scale P2P networks, the proposed CFL hierarchically aggregates local contributions through the multi cyclic transmission. Also, the proposed CFL resists hijacking attacks by a proposed voting-based key revocation mechanism when establishing communication keys. To the best of our knowledge, the proposed CFL protocol is the first finegrained model training protocol for FL in large-scale P2P networks, which is efficient and privacy-preserving.

System Model, Security Requirements and Design Goal
In this section, we formalize the system model, propose the security requirements, and identify the design goal.

System Model
In this paper, we consider the FL in large-scale P2P networks, which is an expansion of the system model of PPT [9] in terms of client amount. Specifically, as shown in Fig. 1, a large group of potential clients U = {u i |i = 1, 2, · · · , Z} with constant wireless communication ranges are distributed in a large-scale P2P network. The clients truly participate in the global model training process are target clients, denoted by C = {c i |i = 1, 2, · · · , N }, C ⊆ U. Each target client c i has a local dataset D i of size |D i | containing private training data. Besides, a server loosely connected with a few potential clients is responsible for coordinating FL tasks, which means the server cannot aggregate clients' local contributions directly. The goal of target clients is to collaboratively train a global ML model W under the orchestration of the server, where W is usually expressed as a d-dimensional vector in the ML community.
In detail, the collaborative training process is an iteration. For clarity, we take the t-th round as an example to describe the iterative training process. The server first sends the global model W t to the potential clients connected to it directly, and these potential clients pass W t to other potential clients subsequently. After receiving the global model, each target client c i initializes the local model as the global model W t , and trains it on D i to obtain an updated local model w t i through the stochastic gradient descent (SGD) algorithm, which is simply expressed as: where the w t i is a d-dimensional vector. Then, each target client c i calculates its local model update parameters x t i , shown as: Next, all target clients aggregate local model update parameters and upload the aggregation result to the server to update the global model, shown as: where |Di| is the aggregation weight of c i , and W t+1 is the updated global model. All participants under our consideration perform the above training process periodically until the global model converges to an optimal result, i.e., the final converged global model W * .
Communication model. Inherited from the communication characteristics of P2P networks, all data in the system is transmitted through public communication channels, which means the transmitted data could be eavesdropped by any client. In addition, all target clients can only communicate with their single-hop neighbor clients within their constant wireless communication ranges, and only a few clients could communicate with the server directly.

Security Requirements
In the context of FL in large-scale P2P networks, security and privacy are the most important concerns. Thus, we consider two widely used threat models in FL [4,5,9], i.e., the internal semi-honest participants threat model and the external malicious adversaries threat model. We further consider hijacking attacks [16] from external malicious adversaries when establishing communication keys, which is thoughtless in PPT [9].
In the internal semi-honest (also named as honest-but-curious) participants threat model, the server and target clients perform prescribed operations honestly but are curious about others' local model update parameters, which means clients could infer private information from others' local model update parameters by executing model inversion attacks [12]. In particular, honest-but-curious potential clients may execute eavesdropping attacks [27] to obtain the private local model update parameters from target clients, thereby executing model inversion attacks [12] to threaten the privacy of local data.
As shown in Fig. 1, in the external malicious adversaries threat model, a malicious adversary A could execute tampering attacks [27] and impersonation attacks [27] to threaten the data integrity and the authenticity of aggregated local contributions. More seriously, A could execute hijacking attacks, where A hijacks honest participants to obtain the communication keys, and hence tampers with the aggregated model update parameters when aggregating local contributions, resulting in serious security risks. As a result, the proposed protocol should meet the following security requirements: -Privacy preservation. Neither an honest-but-curious server nor clients can obtain others' precise local model update parameters. Also, the aggregated model update parameters should be only obtained by the sender and receiver but others during the transmission process. -Data integrity and authenticity. Ensure that local model update parameters are indeed sent by a legitimate client and have not been tampered with during transmission. That is, active attacks executed by A should be resisted. -Confidentiality of the communication keys. The communication key used to protect the aggregated model update parameters during transmission can only be obtained by the two corresponding target clients. In other words, hijacking attacks executed by A should be detected and resisted.

Design Goal
Under the system model and security requirements, our design goal is to propose an efficient and privacy-preserving global model training protocol for FL in largescale P2P networks. Specifically, the following objectives should be achieved in the proposed protocol: -The security requirements should be guaranteed in the proposed protocol. As mentioned in the security requirements, the proposed protocol should achieve privacy preservation, data integrity and authenticity, and the communication key confidentiality simultaneously under the internal semi-honest participants threat model and the external malicious adversaries threat model. -Communication and computational efficiency should be guaranteed in the proposed protocol. Although more clients are involved in FL in large-scale P2P networks, the proposed protocol should ensure communication efficiency. In addition, the proposed protocol should reduce the computational cost of a single client to ensure the computational efficiency.

Random Pairwise Keys Scheme
The random pairwise keys scheme [8] is initially deployed in distributed networks to establish communication keys. The basic idea is to associate two potential clients with a pairwise key based on their identities. The detailed steps of the random pairwise keys scheme are described as follows: - Step-1. All potential clients generate their unique identities, denoted by ID = {ID i |i = 1, 2, · · · , Z}. -Step-2. Each potential client randomly matches its identity with M other identities, and each client pair obtains a pair-wise k from a key pool K. -Step-3. The pair-wise k and the identity of the matching client are stored in both clients' key rings, denoted by R i = {(ID iα , k iα )|α = 1, 2, · · · , M }. -Step-4. Through the challenge-response mechanism, each potential client uses its key ring to establish communication keys with other potential clients that have common keys.

Authenticated Encryption
Authenticated encryption [2] is an encryption scheme that provides both security and authentication, which comprises three algorithms: the key generation algorithm AE.Gen(·), the encryption algorithm AE.Enc(·), and the decryption algorithm AE.Dec(·). The detailed steps of the authenticated encryption are as follows:  ○ AE.Gen(·) generates a symmetric key K, which is simply expressed as: where κ is a security parameter, i.e. the length of the symmetric key which is consistent with the length of each dimension of the local model.  ○ AE.Enc(·) inputs the plaintext X and the key K and outputs the ciphertext Y and an authentication tag σ in the form of a message authentication code (MAC), which is simply expressed as: where || represents the string concatenation operator.  ○ AE.Dec(·) inputs the ciphertext Y and the corresponding key K and outputs the plaintext X, which is simply expressed as: If the σ fails authentication, AE.Dec(·) outputs an unauthenticated symbol.

System Design
In this section, we propose an efficient and privacy-preserving Cluster Federated Learning (CFL) global model training protocol for FL in large-scale P2P networks. The proposed CFL protocol mainly consists of the following five parts: cluster division, communication key establishment, local model training, aggregation within a single cluster, and aggregation and update across clusters.

Cluster Division
There are large amounts of clients distributed in a large-scale P2P network under our consideration, where the complex connections among clients may bring huge communication latency if aggregating all local contributions directly. Therefore, we first divide all potential clients into several clusters L = {L h |h = 1, 2, · · · λ} based on their constant wireless communication ranges, shown in Fig. 1. Note that, since only a few potential clients are directly connected to the server in each cluster, the potential clients and their connections within the cluster can also be regarded as a P2P network. Thus, the local contribution can be aggregated hierarchically, i.e., aggregation within a single cluster and aggregation across clusters subsequently. We stress that such a hierarchical aggregation process is named as multi cyclic transmission, since the aggregation processes within several clusters are performed simultaneously, which is more communicationefficient than cyclic transmission of the PPT protocol [9], where all participants aggregate local contributions in a cyclic manner directly. For gravity, we regularize the symbols in a specific cluster L h ∈ L. The potential clients in L h are denoted by U h = {u h,i |i = 1, 2, · · · , z h }, and all U h (h = 1, 2, · · · , λ) make up U, i.e., U = λ h=1 U h . The clients that actually participate in a specific round of global model training are target clients,

Communication Key Establishment
To enhance the security while transmitting local model update parameters, we propose a Secure Communication Key Establishment Protocol in Fig.  2 to establish communication keys for potential clients within a single cluster,

Secure Communication Key Establishment Protocol
• Communication key establishment: -Each potential client u h,i generates its identity ID h,i .
-Each identity is matched with m h other randomly selected identities.
-Each client pair associated with two identities obtains a pairwise key from a key pool K. -All identities and the corresponding keys make up u h,i 's key ring where ν denotes the vote is marked. -If the number of marked votes is not less than l h , A will be revoked.  which is an important part of the proposed CFL protocol and comprises three parts, i.e., Communication key establishment, Key revocation, and Re-keying.
• Communication key establishment. Without loss of generality, we take the cluster L h as an example. Each potential client u h,i first generates a unique identity ID h,i . Then, u h,i randomly matches its identity with m h other identities, and each client pair obtains a pairwise key from a key pool K containing sufficient keys. Thus, m h sets of identities and the corresponding pairwise keys make up the key ring R h,i = {(ID h,iα , k h,iα )|α = 1, 2, · · ·, m h } which is stored locally on u h,i . Note that the above offline operations do not consume communication resources.
Afterwards, all potential clients discover other potential clients that have shared keys with them through the challenge-response mechanism. Specifically, u h,i broadcasts a plaintext a h,i and m h messages {A h,iα |α = 1, 2, · · · , m h } encrypted by m h pairwise keys {k h,iα |α = 1, 2, · · · , m h } in R h,i , shown as: where CK.Enc(·) is the symmetric encryption algorithm. After that, every other potential clients u h,j (j = i) attempts to decrypt the ciphertexts successively using the locally stored m h pairwise keys in its key ring, shown as: where a h,i is the decryption result. Consequently, u h,j compares a h,i with the plaintext a h,i , seeking for shared keys. Thus, u h,i and u h,j execute XOR operations for all shared keys to obtain a communication key K hi,hj .
• Key revocation. In the external malicious threat model under our consideration, an adversary A can hijack honest potential clients to obtain the communication keys, thereby threatening the security of the system. Thus, we design a compact and efficient key revocation mechanism based on public voting.
In detail, once a potential client observes active attacks from the client A hijacked by A, it broadcasts a negative vote. We define the voting members as {u h,A α |α = 1, 2, · · · , m h } who are single-hop neighbors of A . Once A is voted against more than l h , all voting members would cut off all connections to A for revocation, thereby eliminating the A's influence on the system.
In particular, the neighborhood broadcast [3] mechanism is used for every public vote in the network. The mechanism adopts broadcasts between neighbors to hierarchically make a consensus in the network. We stipulate that all voting members need to broadcast any public votes received to maximize the probability of successful transmission to adjacent voting members. All broadcasts are in the form of plaintext, as the voters' identities have no need to be protected. The detailed voting process is demonstrated in Fig. 2.
• Re-keying. To ensure the long-term security of the system, the communication keys used for a period of time need to be updated. When the keys expire, the Re-keying part will start. That is, all affected clients restart the Communication key establishment part to rebuild new communication keys.

Local Model Training
After establishing communication keys, all potential clients collaboratively train the global model. Taking the t-th round as an example, the server first distributes a global model W t to the potential clients directly connected to it. These potential clients subsequently pass W t to other potential clients within the same cluster. After receiving W t , each target client c h,i initializes the local model as W t , and trains it on its local dataset D h,i , shown as: Then, c h,i calculates the local model update parameters, shown as: Afterwards, c h,i calculates its weighted local model update parameters  After local training, all target clients aggregate their local model update parameters within their clusters respectively. The server randomly selects a target client directly connected to it as the leader client, namely c h,1 . Then, c h,1 generates a random noise s t h to disturb its weighted local model update parameters X t h,1 , shown as:

Aggregation within a Single Cluster
where s t h is a d-dimensional vector. Subsequently, c h,1 attaches a timestamp τ t h,1 to the disturbed model update parameters, which is represented asX t h,1 ||τ t h,1 . Next, c h,1 randomly selects a neighbor client c h,2 and encryptsX t h,1 ||τ t h,1 using their communication key K h1,h2 , shown as: Then, c h,1 sends Y t h,1 ||σ t h,1 to c h,2 , and c h,2 recovers it subsequently, shown as: After validating the timestamp τ t h,1 , c h,2 aggregates its own weighted model update parameters, shown as: Subsequently, c h,2 selects a new neighbor client c h,3 , and performs the encryption and transmission operations as c h,1 does. The remaining target clients perform the same decryption, aggregation, encryption, and transmission operations successively until all the target clients are traversed. Note that the aggregation route follows the depth-first traversal algorithm in the graph [29], where each target client prefers to select the target clients that have not yet participated in the aggregation. Finally, the final client c h,n h sends the aggregated model update parameters back to c h,1 . c h,1 subtracts the noise s t h to obtain the aggregation result within its cluster, denoted by sum t h and defined as: To make a consensus on the aggregation route, we also adopt the neighborhood broadcast [3] mechanism during transmission, where each target client hierarchically broadcasts its behaviors to all clients. With the deployment of the neighborhood broadcast mechanism, dropout-robustness is guaranteed.
For gravity, we illustrate the model aggregation process within a single cluster as the Inner-Cluster Model Aggregation Protocol in Fig. 3.

Aggregation and Update Across Clusters
After finishing the model aggregation within each single cluster, each leader client c h,1 could obtain the inner-cluster aggregation result sum t h . Next, each leader client uploads sum t h directly to the server, and the server aggregates all sum t h , h = 1, · · · , λ, shown as: where |Di| is the aggregation weight of the cluster L h . Consequently, the server updates the global model, shown as: Finally, the server distributes the updated global model to all potential clients, and the target clients iteratively train and aggregate until the global model converges to W * .
For clarity of description, we illustrate the integrated CFL protocol from a high-level view in Fig. 4.

CFL for FL in Large-Scale P2P Networks (high-level view)
Step 1. All potential clients distributed in the P2P network are divided into several clusters according to their wireless communication range.
Step 2. The potential clients in each cluster establish communication keys according to the Secure Communication Key Establishment Protocol.
Step 3. All target clients in every cluster perform local model training.
Step 4. All target clients within each single cluster perform aggregation according to the Inner-Cluster Model Aggregation Protocol.
Step 5. All target clients perform aggregation across clusters to obtain the global model update parameters. Step 6. The server updates the global model.
Step 7. The server distributes the updated global model to all potential clients.
Step 8. The server determines whether the global model converges: If so, stop training; Otherwise, go back to step 3. Note:  ○ The neighborhood broadcast mechanism is adopted to record the behaviors of all clients.  ○ A newly joined client unew will perform step 2-8.

Analysis
In this section, we analyze the security properties of the proposed CFL protocol under the internal semi-honest participants threat model and the external malicious adversaries threat model. Particularly, we analyze the network connectivity, which is critical for secure communication among clients.

Security Analysis
In the internal semi-honest participants threat model, we mainly focus on the privacy requirements facing the honest-but-curious server, target clients, and potential clients.
The proposed CFL protocol is privacy-preserving facing an honest-but-curious server. An honest-but-curious server may infer the private local training data from clients' local contributions by executing model inversion attacks [12]. To defend against such inferences, the proposed CFL protocol aggregates local contributions in a privacy-preserving manner, where the server can only obtain the aggregation result rather than the private local model update parameters.
The proposed CFL protocol is privacy-preserving facing honest-but-curious target clients. An honest-but-curious target client may also execute model inversion attacks [12] to threaten the privacy contained in the local datasets. To resist such attacks, a random noise is introduced to disturb the aggregated model update parameters. Therefore, all target clients can only get disturbed local contributions or the intermediate aggregation results, rather than the precise local model update parameters.
The proposed CFL protocol is privacy-preserving facing honest-but-curious potential clients. An honest-but-curious potential client may execute eavesdropping attacks [27] to obtain the intermediate aggregation result. Thus, the proposed CFL protocol adopts the authenticated encryption to protect aggregated model update parameters. Therefore, an honest-but-curious potential client cannot eavesdrop the plaintext of other's local model update parameters.
Furthermore, in the external malicious threat models, we discuss the data integrity and authenticity of the aggregated model update parameters and the confidentiality of the communication keys.
The proposed CFL protocol guarantees the data integrity and authenticity of the aggregated model update parameters. A malicious adversary can execute tampering attacks [27] and impersonation attacks [27] to threaten the data integrity and authenticity of the aggregated model update parameters. To defend against such attacks, the proposed CFL protocol adopts authenticated encryption to protect aggregated model update parameters, where the authentication tag can effectively resist unauthorized tampering of messages and verify whether the sender is a trusted source.
The proposed CFL protocol guarantees the confidentiality of the communication keys. More seriously, a malicious adversary can hijack honest participants, which may lead to the leakage of the communication keys, resulting in various attacks to threaten the security of the system. Thus, the Secure Communication Key Establishment Protocol is enhanced by a voting-based key revocation mechanism to remove the contaminated keys, thereby eliminating the possibility of malicious adversaries stealing communication keys. Therefore, the confidentiality of the communication key is ensured.

Network Connectivity Analysis
In the proposed CFL protocol, we use the Secure Communication Key Establishment Protocol to establish communication keys for potential clients. We analyze the network connectivity based on the established communication keys in Theorem 1, which is the basis of secure transmission. Theorem 1. For a cluster L h , the size of the key ring for each potential client only needs to be m h to ensure a high network connectivity probability.
Proof. We first formalize the network topology in cluster L h as a random graph G(n h , r h ), where n h is the amount of potential clients in L h , and r h ∈ [0, 1] is the probability that any two potential clients are connected.
To reflect the desired connectivity probability P c of G(n h , r h ), we recall Lemma 1.

Lemma 1 ([7]
). Given a desired connectivity probability P c for a graph G(n h , r h ), the threshold function r h is defined by: where r h = ln(n h ) n h + c n h , and c is any real constant.
According to Lemma 1, given a high connectivity probability (e.g., 0.999), we can calculate r h as follows: Thus, we can infer that a graph with n h vertices has at most n h 2 edges [6]. Assume that G(n h , r h ) has e edges, we can calculate r h as follows: Next, we can calculate the key ring size m h of the potential client, i.e., the expected degree of G(n h , r h ), shown as: Therefore, according to the equations (17) and (18), we can figure out the relationship between m h and r h as: where ∼ represents an equivalence symbol. As a result, according to the equation (16), we can calculate the key ring size m h as: which complete the proof.
Theorem 1 indicates that the size of the key ring of each potential client only needs to be m h = ln(n h ) − ln(− ln(P c )) for a high network connectivity probability. In other words, given the size of the key ring m h , all aggregation results can be transmitted in ciphertext with a high probability.

Experiments and Evaluation
In this section, we conduct the experiments in a spam classification scenario. All experiments are implemented on the same computing environment (Linux Ubuntu 16.04, Intel i7-6950X CPU, 64 GB RAM and 5TB SSD) with Tensorflow, Keras and PyCryptodome.

Experimental Design
Dataset. The datasets used in our experiments consist of Trec06p 1 and Trec07 1 , which are two English e-mail datasets from the real world. The Trec06p dataset contains 12910 hams and 24912 spams in the main corpus with messages, and the Trec07 dataset contains 25220 hams and 50199 spams. Network connectivity topology. As shown in Fig. 5, in our experiments, there are 200 potential clients distributed in a large-scale P2P network which is divided into five clusters. Among the potential clients, 100 target clients are illustrated as the gray nodes, and the black nodes are leader clients. Further, we illustrate the connections among potential clients based on the communication keys as the gray lines and the aggregation route as the red lines. Parameter tuning. In our experiments, all target clients use the local datasets to collaboratively train a global model according to the proposed CFL protocol. It is worth mentioning that the Trec06p dataset is divided into the Trec06p training set and the Trec06p testing set according to the ratio of 3:1, and the Trec06p training set is adopted to train the original global model. In addition, the Trec07 dataset is divided into two parts. One part is further divided into 100 local datasets for target clients, and the set size follows a normal distribution of mean 600 and variance 100. The other part serves as the Trec07 testing set to evaluate the global model performance. The original global model and local models have the same structure, which consists of two convolution layers, two pooling layers, and three fully connected layers. We also set the loss function as the cross-entropy error and the active function as the ReLU. The gradient descent algorithm is set as SGD with the learning rate of 0.1. Besides, we use the AES-GCM-128bit algorithm [23] for authenticated encryption.

Experimental Results and Evaluation
In order to validate the model performance of the proposed CFL protocol, we evaluate the accuracy and loss value of the global model in Fig. 6.     Besides, in order to validate the dropout-robustness of the proposed CFL protocol, we randomly set 15% dropout clients in each training round. As shown in fig. 6, in this case, the global model converges at 16 rounds, and the accuracy and loss value of the global model are 99.26% and 0.0343, which are close to the values without dropout clients. Such a result shows that the proposed CFL protocol ensures the classification accuracy and the convergence rate of the global model facing dropout issues. Similar results can also be observed in Fig. 7, where the final global model obtains AUC values of 0.97 and 0.98 on the Trec06p and Trec07 testing sets, which also reflect the dropout-robustness of the proposed CFL protocol.
More importantly, to demonstrate the communication efficiency of the proposed CFL protocol, we record the averaging communication times achieving a round of aggregation in TABLE I. Compared to the PPT protocol [9], CFL improves the communication efficiency by about 43.25%. Such an improvement benefits from the cluster-based division. It is worth mentioning that the communication times are not necessarily negatively correlated with the number of dropout clients but are related to the distribution of network topology. In addition, we record the time of each operation in TABLE II, where the authenticated encryption (decryption) in our protocol consumes less time than the encryption (decryption) and signature (verification) in the PPT protocol [9], which achieves a 0.87% improvement in terms of computational efficiency. TABLE II also shows the time for a single leader client in our protocol to perform noise generation, addition, and subtraction operations, which are almost the same as the PPT protocol. Noise subtraction 0.1316 † Local model update parameters size: 114MB in plaintext and 428.8MB in ciphertext. * Based on the same experimental settings, we directly use the results of relevant operation time in the PPT protocol [9] for comparison.

Conclusion
Aiming to solve the problems of a single point of failure and high communication costs in FL, we propose a CFL protocol for FL in large-scale P2P networks, focusing on efficient and privacy-preserving model training. Some interesting researches could further improve CFL in the future. On the one hand, an effective design for FL in dynamic P2P networks could flourish the development of decentralized FL in practice. On the other hand, along with the hardware development of clients, a computation-friendly homomorphic encryption algorithm could improve the communication efficiency of the system more.