arXiv:2602.02629v2 Announce Type: replace-cross

Abstract: Federated learning allows hospitals to train a shared clinical model without exchanging patient records, but its aggregation assumes that each participant is a distinct institution. In an open federation, an adversary can register many fake identities (a Sybil attack) and outweigh honest hospitals. Byzantine-robust aggregation mitigates such attacks only while the adversary is a minority. We ask whether binding participation to accountable institutional identity closes that gap, and at what cost. We present TBFL, a framework in which an accountable authority issues Verifiable Credentials to the Decentralized Identifiers of hospitals, and a smart-contract registry on a peer-to-peer ledger admits model updates only from credentialed senders. We evaluated a prototype on in-hospital mortality prediction with MIMIC-IV records split across simulated hospitals, comparing the identity gate with federated averaging, three robust aggregators, norm clipping, and a similarity-based defense. Robust aggregators held against a Sybil minority, and norm clipping only against random vectors; all failed when half the participants were Sybils trained on real records with flipped labels. The similarity-based defense stopped mutually similar Sybils but yielded to perturbed ones. The gate rejected all unauthorized submissions and maintained attack-free performance for every strategy up to 60% Sybils. It did not stop credentialed hospitals that flipped their own labels, whereas the gate followed by the coordinate-wise median withstood both. On a local node, on-chain checks added about 1% to training time; fees made training impractical on a public mainnet but affordable on a rollup. Identity gating complements robust aggregation rather than replacing it.