Secure Aggregation

The central server learns only the aggregated sum of all client updates. Individual gradient vectors remain cryptographically hidden from the server, other clients, and any passive network eavesdropper. This is achieved through secret sharing and pairwise masking, where clients add random noise that cancels out only when all shares are combined. The protocol is secure against a honest-but-curious server that follows the protocol correctly but attempts to infer private data.

Federated learning environments are inherently unreliable. Mobile devices disconnect, laptops go to sleep, and network links fail. Secure aggregation protocols are designed to tolerate a configurable fraction of client dropouts without stalling the entire round. The protocol achieves this by having clients share secret shares of their masks with a subset of peers. If a client drops out, the remaining clients can reconstruct the missing mask to unblind the aggregate, ensuring the computation completes successfully.

Unlike general-purpose secure multi-party computation (SMPC) or fully homomorphic encryption (HE), secure aggregation is a special-purpose protocol optimized for the single operation of summation. This narrow scope allows for dramatic performance improvements:

• Communication: O(n + k) where n is the number of clients and k is the model size
• Computation: Primarily relies on fast symmetric-key operations and modular arithmetic
• No public-key crypto in the inner loop, making it practical for large deep learning models with millions of parameters

Beyond passive adversaries, secure aggregation can be hardened against active adversaries that deviate from the protocol. Techniques include:

• Commitment schemes that bind clients to their inputs before revealing masks
• Zero-knowledge range proofs to ensure inputs are within valid bounds
• Consistency checks that prevent clients from sending different shares to different peers These mechanisms ensure that a malicious client cannot corrupt the aggregate or cause the protocol to abort without detection.

Secure aggregation is often combined with differential privacy (DP) to provide a formal privacy guarantee against inference from the final model. While secure aggregation hides individual updates from the server during transmission, the aggregate itself may still leak information. By having clients add calibrated Gaussian noise to their updates before encryption, or by having the server add noise post-aggregation, the system achieves a bounded privacy budget (epsilon) that limits what can be inferred from the published model.

The standard security model assumes a honest-but-curious server and an honest majority of clients. The protocol does not protect against a server that actively lies about the aggregate result or a coalition of malicious clients that collude to extract another client's input. For stronger threat models, secure aggregation must be combined with:

• Trusted Execution Environments (TEEs) for attested computation
• Verifiable aggregation using zero-knowledge proofs
• Byzantine-robust aggregation rules that filter out anomalous updates

A distributed training paradigm where a shared global model is trained across decentralized devices or servers holding local data. Raw data never leaves the client device—only model updates are transmitted.

• Centralized FL: A coordinating server orchestrates rounds and aggregates updates
• Decentralized FL: Peers communicate directly without a central coordinator
• Cross-silo FL: Small number of reliable institutional clients (e.g., hospitals)
• Cross-device FL: Massive scale with unreliable edge devices (e.g., smartphones)

Secure aggregation is the protocol that protects the model update transmission step in this workflow.

A mathematical framework providing provable privacy guarantees by adding calibrated noise to data or model outputs. The key parameter epsilon (ε) quantifies the privacy loss budget—lower values indicate stronger privacy.

• Local DP: Noise added on each client device before data leaves
• Central DP: Noise added by a trusted aggregator after collecting raw inputs
• DP-SGD: Clips per-sample gradients and adds Gaussian noise during training

Often combined with secure aggregation to provide defense-in-depth: aggregation hides individual updates during transmission, while DP bounds what can be inferred from the final model.

A cryptographic protocol enabling multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. Unlike secure aggregation—which is specialized for summation—SMPC supports arbitrary computations.

• Garbled circuits: Boolean circuit evaluation via encrypted gates
• Secret sharing: Splitting inputs into shares distributed across parties (e.g., Shamir's scheme)
• Oblivious transfer: A party sends one of many pieces of information without knowing which was received

SMPC provides stronger guarantees than secure aggregation but incurs significantly higher communication and computation overhead, making it less practical for large-scale FL.

An encryption scheme allowing computation directly on ciphertexts. The result, when decrypted, matches the result of operations performed on the plaintext. This eliminates the need to decrypt data before processing.

• Partially HE (PHE): Supports only addition OR multiplication (e.g., Paillier for additive aggregation)
• Somewhat HE (SHE): Supports limited depth of both operations
• Fully HE (FHE): Supports arbitrary computation on encrypted data (e.g., CKKS, TFHE schemes)

In federated learning, additive HE can replace secure aggregation by having clients encrypt updates before transmission. The server sums ciphertexts without ever seeing plaintext values.

The reconstruction of private training data from publicly shared model gradients during distributed training. Even without raw data access, an honest-but-curious server can invert gradients to recover input images, text, or records.

• Deep Leakage from Gradients (DLG): Iteratively optimizes dummy inputs to match observed gradients
• Inverting Gradients (IG): Uses cosine similarity loss to reconstruct high-fidelity images
• Analytical attacks: Directly solve for inputs in fully-connected layers

Secure aggregation directly mitigates this threat by ensuring the server only sees the aggregated sum of gradients, not individual client contributions, making inversion attacks computationally infeasible.

A hardware-enforced secure enclave within a processor that guarantees confidentiality and integrity of code and data loaded inside it. The host OS, hypervisor, and even cloud provider cannot inspect enclave memory.

• Intel SGX/TDX: Application-level and VM-level enclaves
• AMD SEV-SNP: Encrypted VM memory with attestation
• ARM Confidential Compute Architecture (CCA): Realm-based isolation

TEEs offer an alternative to cryptographic secure aggregation: clients send encrypted updates to an enclave that decrypts and aggregates in hardware-protected memory, then outputs only the aggregate. This provides strong security with lower overhead than SMPC or HE.