Secure Aggregation

Clients establish shared secrets with each other using Diffie-Hellman key agreement. These secrets seed a pseudorandom number generator to create pairwise masks. Each client adds a mask for every other client to its update. When the server sums all masked updates, the pairwise masks mathematically cancel out, revealing only the aggregate sum.

• Mechanism: mask_ij = PRNG(DH(sk_i, pk_j))
• Cancellation: mask_ij + mask_ji = 0
• Result: Server sees Σ(update_i), never update_i in isolation

To handle clients that drop out mid-protocol, each client splits its private key into t-out-of-n shares using Shamir's Secret Sharing and distributes them to all other clients. If a client goes offline, a quorum of remaining clients can reconstruct the missing mask, preventing the aggregate from being corrupted.

• Threshold: Requires t shares to reconstruct
• Resilience: Survives up to n - t dropouts
• Security: Adversary must compromise t clients to unmask

The central server acts as an honest-but-curious aggregator. It facilitates communication but never possesses the keys to decrypt individual updates. The protocol provides a zero-knowledge guarantee: the server learns the sum and nothing else. This is critical for HIPAA compliance in healthcare federated learning.

• Server role: Relay and sum only
• Information learned: Σ(updates) exclusively
• Regulatory alignment: Satisfies data minimization principles

Secure aggregation protocols include a recovery round where surviving clients upload shares of the private keys belonging to dropped clients. The server reconstructs the missing masks and removes them from the aggregate. This ensures a single straggler cannot stall the entire training round.

• Phase 1: Clients detect dropouts via timeout
• Phase 2: Surviving clients send key shares
• Phase 3: Server reconstructs and unblinds

Secure aggregation introduces communication and computation overhead proportional to the number of clients. Each client must perform O(n) Diffie-Hellman key exchanges and generate O(n) masks. For cross-silo settings with 10-50 hospitals, this is negligible. For cross-device with millions of phones, optimized sub-sampling is required.

• Cross-silo: < 5% overhead on training time
• Cross-device: Requires client sub-sampling
• Optimization: Use of elliptic curve cryptography

Secure aggregation is often combined with differential privacy to provide defense-in-depth. While secure aggregation protects updates in transit, a malicious client could still infer information from the final aggregate model. Adding calibrated Gaussian noise to the sum before model update provides a formal privacy guarantee.

• Secure Aggregation: Protects individual updates
• Differential Privacy: Protects against aggregate inference
• Combined: Defense against server and client-side adversaries

A security vulnerability where raw model gradients are analytically inverted to reconstruct private training data. Secure aggregation directly mitigates this attack vector by ensuring the server never sees individual gradients.

• Deep Leakage from Gradients (DLG): Iteratively optimizes dummy inputs to match observed gradients
• Inverting Gradients: Exploits the fully connected layer to reconstruct images
• Effective against honest-but-curious servers
• Motivating threat model for secure aggregation adoption

The resilience property allowing a distributed system to reach correct consensus despite arbitrary malicious behavior from a subset of nodes. In federated learning, BFT aggregation rules complement secure aggregation by detecting and mitigating poisoned updates.

• Krum: Selects the update closest to a majority cluster
• Trimmed Mean: Discards extreme values before averaging
• Median-based aggregation: Robust to outliers in each coordinate
• Addresses the threat of model poisoning attacks