Secure Multi-Party Computation (SMPC)

The foundational mechanism ensuring that no party's private data is ever revealed to another. Instead of sending raw data, inputs are split into mathematically random shares and distributed among participants.

• Additive Secret Sharing: A value x is split into random numbers x1, x2, ..., xn such that their sum equals x. No single share reveals any information about the original value.
• Shamir's Secret Sharing: Uses polynomial interpolation, requiring a threshold t of shares to reconstruct the secret, providing robustness against dropouts.
• In the context of federated learning, this means a base station's local model update is hidden from the aggregator and other peers during the computation phase.

A protocol, pioneered by Andrew Yao, that allows two parties to evaluate any Boolean circuit securely. One party (the garbler) encrypts the logic gates of the function, while the other (the evaluator) computes the output without learning intermediate values.

• The function to be computed is represented as a Boolean circuit.
• The garbler assigns two random cryptographic labels to each wire (representing 0 and 1).
• The evaluator uses Oblivious Transfer (OT) to retrieve the labels corresponding to their private input without revealing it.
• This is highly effective for functions with fixed, shallow logic, such as secure comparison or thresholding operations on model updates.

The security model of an SMPC protocol defines the adversary's power and directly impacts performance. The choice of model is a critical engineering trade-off.

• Honest-Majority (e.g., n > 2t): Assumes a majority of parties follow the protocol correctly. Enables extremely fast, information-theoretic security with low communication overhead. Ideal for cross-silo federated learning among trusted institutions.
• Dishonest-Majority: Tolerates arbitrary corruption where an adversary controls most parties. Requires computationally expensive cryptographic assumptions (e.g., Fully Homomorphic Encryption or Zero-Knowledge Proofs) to enforce correct behavior.
• Active vs. Passive Adversaries: A passive (semi-honest) adversary follows the protocol but tries to learn private data from received messages. An active (malicious) adversary can arbitrarily deviate from the protocol.

SMPC protocols operate on different algebraic structures, and the choice between them significantly impacts efficiency for machine learning workloads.

• Arithmetic Secret Sharing: Operates over a large finite field (e.g., integers modulo a prime p). Extremely efficient for linear operations like matrix multiplication and addition, which dominate neural network training.
• Boolean Secret Sharing: Operates on single bits using XOR operations. Necessary for non-linear functions like ReLU, max-pooling, and comparisons.
• Mixed-Circuit Protocols: Modern frameworks dynamically switch between arithmetic and Boolean representations to optimize end-to-end secure inference and training, minimizing the cost of non-linear activation functions.

The termination guarantees of an SMPC protocol define what happens if a malicious party tries to abort the computation prematurely, a critical consideration for adversarial federated learning environments.

• Guaranteed Output Delivery (G.O.D.): The strongest guarantee. Honest parties always receive the correct output regardless of malicious behavior. Requires a strict honest-majority assumption.
• Fairness: A weaker guarantee ensuring that if any party learns the output, all parties learn it. A malicious party cannot abort the protocol after gaining an advantage.
• Security with Abort: The most common practical model. A malicious party can force the protocol to halt, but they cannot violate input privacy or corrupt the output. The honest parties detect the cheat and abort without learning the result.

The primary engineering challenge in deploying SMPC for federated learning is not computation, but the volume of data exchanged between parties during secure multiplication.

• Preprocessing Model: Offloads expensive, input-independent cryptographic material (e.g., Beaver triples for multiplication) to an offline phase. The online phase becomes extremely fast, requiring only lightweight linear operations.
• Triple Generation: A Beaver triple is a set of secret-shared values (a, b, c) where c = a * b. These are consumed to perform a secure multiplication with minimal interaction.
• Latency Sensitivity: In wide-area network deployments across telecom operators, the round-trip time dominates total execution time, driving the need for constant-round protocols.

A foundational building block of many SMPC protocols where a secret value is split into multiple shares distributed among participants, such that no single share reveals any information about the original secret. The most common scheme is Shamir's Secret Sharing, which encodes a secret as the constant term of a random polynomial and distributes points on that polynomial as shares. Reconstruction requires a threshold number of shares. In SMPC, additive secret sharing is widely used: a value x is split into random shares x₁, x₂, ..., xₙ such that x = x₁ + x₂ + ... + xₙ. This enables linear operations to be performed locally on shares without interaction, while multiplication requires communication between parties.