Secure Aggregation

A cryptographic primitive enabling computation directly on ciphertext. In secure aggregation, clients encrypt their model updates; the server computes the sum over encrypted data, producing an encrypted result that decrypts to the correct aggregate. Additively homomorphic schemes like Paillier are commonly used because summation is the core operation. This prevents the server from ever seeing individual plaintext updates, even during computation.

A cryptographic subfield enabling multiple distrusting parties to jointly compute a function over their private inputs while keeping those inputs secret from each other. In federated learning, SMPC can replace a trusted aggregator by having clients exchange secret shares of their model updates. The server collects shares and reconstructs only the sum, ensuring no single party—including the server—can inspect an individual contribution.

A mathematical framework that formally bounds information leakage from a computation. When combined with secure aggregation, differential privacy adds calibrated noise to the aggregated sum before the server decrypts it. This ensures that even the final global model does not inadvertently memorize or reveal any single client's data. The privacy budget, epsilon (ε), controls the trade-off between privacy strength and model accuracy.

The resilience property ensuring a distributed system reaches correct consensus despite arbitrary node failures or malicious behavior. In secure aggregation, a Byzantine client might send crafted updates to corrupt the global sum. Byzantine-robust aggregation rules—such as coordinate-wise median or trimmed mean—replace simple averaging to filter out anomalous contributions before they poison the model.

A hardware-enforced isolated area within a processor that guarantees code and data confidentiality even against a compromised operating system. In secure aggregation, the aggregation logic runs inside a TEE (e.g., Intel SGX, AMD SEV). Clients receive remote attestation proving the enclave's integrity, then send encrypted updates directly to the TEE, which decrypts, aggregates, and re-encrypts the result without the host ever seeing plaintext.

A protocol allowing a prover to convince a verifier that a statement is true without revealing any information beyond validity. In secure aggregation, a client can generate a zero-knowledge proof that their encrypted update was computed correctly on legitimate data, without exposing the update itself. This prevents malicious clients from injecting poisoned updates while maintaining full privacy of their local gradients.