Homomorphic Encryption

A cryptographic protocol enabling multiple distrusting parties to jointly compute a function over their private inputs without revealing those inputs to one another. In the context of federated learning, SMPC can replace a trusted central aggregator by ensuring that the server only learns the aggregated model update, not individual client gradients.

• Secret Sharing: Data is split into random shares distributed among parties; no single share reveals the original input.
• Garbled Circuits: A method for secure two-party computation where a function is represented as a Boolean circuit and encrypted.
• Telecom Application: Enables competing operators to jointly train a mobility prediction model without exposing their proprietary user location data.

A secure, isolated area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. TEEs provide a hardware-rooted trust anchor for protecting sensitive model aggregation logic from the host operating system or a compromised hypervisor.

• Intel SGX/TDX: Hardware-grade isolation creating encrypted memory enclaves on Xeon processors.
• ARM TrustZone: A system-wide approach partitioning the SoC into secure and non-secure worlds.
• Attestation: A cryptographic mechanism proving to a remote party that a specific, untampered software stack is running inside the enclave.
• Use Case: An aggregator server processes encrypted model updates inside a TEE, decrypting them only within the secure boundary to perform weighted averaging.

A privacy breach where an adversary exploits access to a trained machine learning model and its confidence scores to reconstruct representative features or specific records from the model's private training dataset. This attack targets the model's internal representations rather than the transmission channel.

• Gradient Leakage: In federated learning, raw training images have been shown to be reconstructable from publicly shared gradients.
• White-box vs. Black-box: Attacks are more potent with full access to model parameters but are still feasible using only prediction APIs.
• Mitigation: Homomorphic encryption prevents the aggregator from inspecting individual gradients, while differential privacy bounds the information content of the model itself.

A privacy attack where an adversary determines whether a specific data record was part of a model's training set by analyzing the model's prediction behavior. This poses a significant risk to data confidentiality, particularly in machine-learning-as-a-service deployments.

• Shadow Models: Attackers train local models to mimic the target model's behavior and learn the distinction between members and non-members.
• Overfitting Signal: Models that overfit their training data exhibit higher confidence on seen examples, creating a detectable signal.
• Defense: Training with differential privacy provides a provable bound against membership inference by limiting the influence of any single training point on the final model parameters.

A cryptographic protocol allowing one party (the prover) to convince another party (the verifier) that a statement is true without revealing any information beyond the validity of the statement itself. In federated learning, ZKPs verify computational integrity without exposing model weights.

• zk-SNARKs: Succinct, non-interactive proofs with fast verification, ideal for resource-constrained verifiers.
• Integrity Verification: A client can prove they correctly computed a gradient update on their local data without revealing the data or the raw gradient.
• Computational Soundness: The protocol ensures a malicious client cannot forge a valid proof for a fraudulent computation.

The resilience property of a distributed system enabling it to reach correct consensus despite an arbitrary subset of nodes exhibiting malicious or arbitrarily faulty behavior. This is a critical requirement for robust federated optimization in adversarial environments.

• Krum Algorithm: A gradient aggregation rule that selects the update closest to a majority of its neighbors, ignoring outliers from Byzantine clients.
• Trimmed Mean: A robust aggregation technique that discards the most extreme values for each parameter coordinate before averaging.
• Telecom Relevance: Protects a global RAN optimization model from being corrupted by a compromised base station injecting malicious updates.