Privacy-Preserving Federated Learning on Oasis Network (Sapphire ParaTime)

Overview

In this tutorial, we’ll build an advanced machine learning system on the Oasis Network using confidential smart contracts (Sapphire ParaTime).

Instead of common examples (NFT auctions, oracles, etc.), we’ll implement:

Confidential Federated Learning with On-Chain Aggregation

The key points on why this tutorial is really on point

• Data never leaves clients in plaintext
• Model updates are encrypted
• Aggregation happens inside TEEs
• Fully privacy-preserving collaborative AI

🧠 Architecture

Clients (Hospitals / Devices)
|
| Encrypted Gradients
v
+-----------------------------+
| Oasis Sapphire ParaTime     |
| |
| - Decrypt gradients (TEE)   |
| - Aggregate updates         |
| - Update global model       |
+-----------------------------+
|
v
Clients download updated model

Tech Stack

• Oasis Sapphire (Confidential EVM)
• Solidity
• Python (PyTorch)
• Web3.py / ethers.js

Step 1: Smart Contract (Confidential Aggregator)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract ConfidentialFederatedLearning {

    struct Update {
        bytes encryptedGradient;
    }

    mapping(address => Update) public updates;
    address[] public participants;

    bytes public globalModel;

    function submitUpdate(bytes calldata encryptedGradient) external {
        if (updates[msg.sender].encryptedGradient.length == 0) {
            participants.push(msg.sender);
        }

        updates[msg.sender] = Update(encryptedGradient);
    }

    function aggregate() external {
        bytes[] memory gradients = new bytes[](participants.length);

        for (uint i = 0; i < participants.length; i++) {
            gradients[i] = updates[participants[i]].encryptedGradient;
        }

        // Executed confidentially in Oasis Sapphire
        globalModel = confidentialAggregate(gradients);

        delete participants;
    }

    function confidentialAggregate(bytes[] memory gradients)
        internal
        returns (bytes memory)
    {
        // Placeholder logic (runs inside TEE)
        return abi.encodePacked("aggregated_model");
    }

    function getModel() external view returns (bytes memory) {
        return globalModel;
    }
}

Step 2: Local Training (PyTorch)

import torch
import torch.nn as nn
import torch.optim as optim

class SimpleModel(nn.Module):
    def __init__(self):
        super().__init__()
        self.fc = nn.Linear(10, 1)

    def forward(self, x):
        return self.fc(x)

def train_local(data, labels):
    model = SimpleModel()
    optimizer = optim.SGD(model.parameters(), lr=0.01)
    loss_fn = nn.MSELoss()

    for _ in range(5):
        optimizer.zero_grad()
        output = model(data)
        loss = loss_fn(output, labels)
        loss.backward()
        optimizer.step()

    return model.state_dict()

Step 3: Serialize + Encrypt Updates

import json
import base64

def serialize_weights(weights):
    return base64.b64encode(json.dumps({
        k: v.tolist() for k, v in weights.items()
    }).encode())

Step 4: Send Updates to Oasis

from web3 import Web3

w3 = Web3(Web3.HTTPProvider("https://testnet.sapphire.oasis.dev"))

contract_address = "YOUR_CONTRACT_ADDRESS"
abi = [...]  # compiled ABI

contract = w3.eth.contract(address=contract_address, abi=abi)

def send_update(encrypted_gradient, private_key):
    account = w3.eth.account.from_key(private_key)

    tx = contract.functions.submitUpdate(
        encrypted_gradient
    ).build_transaction({
        'from': account.address,
        'nonce': w3.eth.get_transaction_count(account.address),
        'gas': 2000000
    })

    signed = account.sign_transaction(tx)
    tx_hash = w3.eth.send_raw_transaction(signed.rawTransaction)

    return tx_hash

Step 5: Trigger Aggregation

def trigger_aggregation(private_key):
    account = w3.eth.account.from_key(private_key)

    tx = contract.functions.aggregate().build_transaction({
        'from': account.address,
        'nonce': w3.eth.get_transaction_count(account.address),
        'gas': 3000000
    })

    signed = account.sign_transaction(tx)
    tx_hash = w3.eth.send_raw_transaction(signed.rawTransaction)

    return tx_hash

Step 6: Fetch Global Model

Once the Oasis network has aggregated all encrypted updates inside the confidential execution environment, clients can retrieve the updated global model.

This step completes the federated learning cycle.

def get_global_model():
    model_bytes = contract.functions.getModel().call()
    return model_bytes

At this stage, the returned model_bytes represent the latest version of the collaboratively trained model.

In a real production system, this data would typically be:

• A serialized PyTorch/TensorFlow model
• Or compressed weight tensors
• Or even encrypted checkpoints for secure distribution

The key idea is that the model itself becomes a shared decentralized artifact, continuously evolving without exposing any participant’s raw data.

Real Use Case #1: Healthcare AI Across Hospitals

One of the most impactful applications of this architecture is in healthcare machine learning.

Problem

Hospitals often cannot share patient data due to strict regulations such as:

• GDPR (Europe)
• HIPAA (United States)

This creates a major bottleneck:

Each hospital has only a partial view of reality.

As a result:

• Disease prediction models are weaker
• Rare conditions are underrepresented
• AI generalization suffers significantly

Solution Using Oasis Confidential ML

With Oasis Sapphire, each hospital:

1. Trains a local model on private patient data
2. Extracts gradients or weight updates
3. Encrypts them automatically via confidential execution
4. Sends updates to the shared aggregation contract

The Oasis network then:

• Aggregates updates inside a Trusted Execution Environment (TEE)
• Prevents any party from seeing individual contributions
• Produces a globally improved model

Why This Works So Well

Instead of centralizing sensitive data, we are centralizing intelligence, not information.

This shift has massive implications:

• Patient data never leaves hospitals
• Research collaboration becomes frictionless
• Models benefit from global diversity of data
• Compliance is preserved by design, not enforcement

In practice, this enables systems like:

• Early disease detection models trained across continents
• Rare condition classifiers with global coverage
• Personalized treatment recommendation systems

Real Use Case #2: Cross-Bank Fraud Detection Network

Another powerful application is in financial systems.

Problem

Banks face a paradox:

• Fraud detection improves with shared data
• But banks cannot share customer transaction data

This leads to:

• Fragmented fraud intelligence
• Delayed detection of new fraud patterns
• High false-negative rates

Solution: Confidential Federated Fraud Learning

Using this architecture:

Each bank:

• Trains a fraud detection model locally
• Learns patterns specific to its users
• Computes gradient updates privately
• Submits encrypted updates to Oasis

Oasis:

• Aggregates all updates confidentially
• Produces a global fraud detection model
• Sends improved model back to all participants

Why This Is Powerful

The system effectively creates a collective fraud intelligence network without violating privacy.

This leads to:

• Faster detection of new fraud patterns
• Cross-bank intelligence without data exposure
• Stronger anomaly detection models
• Reduced financial losses across the ecosystem

Full Training Loop Visualization

Let’s now put everything together into a full lifecycle loop:

ROUND t (Federated Learning Cycle)

Client A (Hospital / Bank / Device)
    └── Train local model
    └── Compute gradients
    └── Encrypt updates
    └── Submit to Oasis

Client B
    └── Train
    └── Encrypt
    └── Submit

Client C
    └── Train
    └── Encrypt
    └── Submit

                ↓

     🔐 Oasis Sapphire TEE Layer
     ┌──────────────────────────────┐
     │ 1. Decrypt securely          │
     │ 2. Aggregate updates         │
     │ 3. Apply weighting (optional)│
     │ 4. Update global model       │
     └──────────────────────────────┘

                ↓

📦 Global Model Updated On-Chain

                ↓

Clients Pull Latest Model → Next Training Round

Advanced Enhancements (Production-Level Thinking)

At this stage, the system is already functional, but real-world deployments require additional sophistication.

1. Differential Privacy Layer

To further strengthen privacy guarantees, we can inject controlled noise into model updates before submission.

This ensures that even in edge cases, individual contributions cannot be reverse-engineered.

def add_noise(weights, epsilon=0.1):
    noisy_weights = {}

    for k in weights:
        noise = torch.randn_like(weights[k]) * epsilon
        noisy_weights[k] = weights[k] + noise

    return noisy_weights

This technique is widely used in privacy-preserving ML systems and complements Oasis’s confidential execution layer.

2. Weighted Aggregation Strategy

Not all participants contribute equally.

For example:

• A hospital with 1M patients should have more influence than one with 1K
• A bank with higher transaction volume should contribute more signal

So instead of simple averaging, we apply weighted aggregation.

This can be implemented inside the confidential contract layer to ensure fairness while preserving privacy.

3. Incentive Mechanism for Participants

A real decentralized ML system must also include economic incentives.

You can design:

• Token rewards per valid update
• Slashing for malicious or low-quality gradients
• Reputation scoring for long-term contributors

This transforms the system into a self-sustaining AI network economy.

4. Hybrid ZK + Confidential ML Systems

An even more advanced extension is combining:

• Zero-Knowledge Proofs (ZKPs)
• Oasis confidential compute

This allows participants to prove properties like:

• 'My model was trained correctly'
• 'My data distribution satisfies constraints'
• 'No poisoning attacks were introduced'

without revealing any underlying data.

So Why Does This Architecture Matter

What we built here is not just a federated learning system.

It represents a shift in how machine learning systems are designed:

From centralized data collection → to decentralized intelligence collaboration

Oasis enables something very rare in blockchain systems:

• Computation on private data
• Without exposing the data itself
• While still preserving verifiability

This unlocks entirely new categories of AI systems:

• Privacy-first foundation models
• Cross-organization collaborative AI
• Decentralized intelligence networks

Where You Can Take This Next

If you want to push this further (and it gets very interesting), you can extend this system into:

• Confidential LLM fine-tuning networks
• Multi-agent decentralized reinforcement learning
• Privacy-preserving recommendation systems
• Genomics ML across research institutions
• Token-incentivized AI training marketplaces

Closing Thought

The combination of federated learning + confidential execution fundamentally changes what is possible in machine learning systems.

Instead of asking:

"Where do we store the data?"

We now ask:

"How do we learn from data without ever seeing it?"

And that is exactly the space where Oasis Network becomes powerful.