← 研踪 PaperTrailarXiv:2611.09277 · v1
Federated Forensics: Jurisdictional constraints as a design driver for multi-agency federated learning
首次提交 2026-11-06 18:33
版本更新 2026-11-06 18:33
雷达观测 2026-11-09 11:19
摘要
Digital forensic investigations increasingly cross borders, and law enforcement agencies need to build analytical models together without centralizing their data. Federated Learning (FL) keeps data local, yet neither FL nor its frameworks enforce the jurisdictional, governance, and accountability rules that multi-agency forensic work requires. This paper takes a design-first approach to that gap. First, we derive seven requirements that a federated learning system must meet in a forensic setting. Second, we propose Federated Forensics, a three-layer reference architecture whose middle layer, unlike in existing hierarchical FL designs, sits at a jurisdictional border and can use a model update locally while blocking it from crossing that border. Third, we build a prototype of the architecture and test it on a malware-family classification task. In a prototype evaluation, the policy gate blocked every restricted update at the border with zero violations, and restricted-class accuracy rose from 0% under today's compliant alternative to 93.0%, only 4.4 points below ignoring the restriction.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-06 18:33 · 最新观测版本
Federated Forensics: Jurisdictional constraints as a design driver for multi-agency federated learning
Digital forensic investigations increasingly cross borders, and law enforcement agencies need to build analytical models together without centralizing their data. Federated Learning (FL) keeps data local, yet neither FL nor its frameworks enforce the jurisdictional, governance, and accountability rules that multi-agency forensic work requires. This paper takes a design-first approach to that gap. First, we derive seven requirements that a federated learning system must meet in a forensic setting. Second, we propose Federated Forensics, a three-layer reference architecture whose middle layer, unlike in existing hierarchical FL designs, sits at a jurisdictional border and can use a model update locally while blocking it from crossing that border. Third, we build a prototype of the architecture and test it on a malware-family classification task. In a prototype evaluation, the policy gate blocked every restricted update at the border with zero violations, and restricted-class accuracy rose from 0% under today's compliant alternative to 93.0%, only 4.4 points below ignoring the restriction.
查看此版本解读 →查看此版本原文 ↗