Secure Aggregation

The core mechanism of Secure Aggregation is pairwise additive masking. Before sending an update, each client adds a secret random mask. Crucially, these masks are structured so they cancel out when all masked updates are summed by the server, revealing only the aggregate. No single client's unmasked update is ever exposed.

• Pairwise Secrets: Clients agree on shared secret keys via a key agreement protocol (e.g., Diffie-Hellman).
• Mask Construction: Each client creates a mask as the sum of secrets shared with every other client, with signs (+/-) arranged to cancel globally.
• Dropout Resilience: The protocol must correctly handle clients that disconnect mid-round, ensuring masks still cancel for the surviving set.

Secure Aggregation provides information-theoretic security for individual updates under a honest-but-curious (semi-honest) adversary model. This means the server, even if it tries to learn private information, gains zero additional knowledge about any client's update beyond what can be inferred from the final sum. The security guarantee is unconditional, not based on computational hardness assumptions, as long as a threshold of clients completes the protocol honestly. This makes it resilient against future advances in cryptography, like quantum computing.

The protocol introduces significant but manageable overhead compared to naive federated averaging.

• Client-to-Client Communication: Clients must establish secret keys, requiring O(n²) messages in the setup phase for n clients, though this can be optimized.
• Increased Payload Size: Masked updates are the same size as model weights, but the cryptographic setup adds overhead.
• Server Computation: The server's primary job is summation, which is linear in the number of clients and model size. The cryptographic verification of signatures and consistency checks adds computational load.
• Trade-off: This overhead is the price for strong, information-theoretic privacy, making it suitable for cross-silo settings with fewer, more reliable participants.

A critical engineering challenge is maintaining correctness when clients inevitably drop out (disconnect) during the protocol. If a client drops after sending its masked update but before the server aggregates, its secret masks will not cancel, corrupting the sum.

• Double-Masking: Practical implementations often use a two-round protocol where clients first commit to their masks.
• Secret Sharing: Clients can secret-share their masking keys with the server or other clients, allowing the aggregate to be reconstructed even if some participants leave.
• Surviving Set: The protocol defines a surviving set of clients, and the aggregation is computed only over their updates, with masks designed to cancel specifically for this set.

Secure Aggregation and Differential Privacy (DP) are complementary privacy techniques. Secure Aggregation hides individual updates from the server, while DP adds noise to protect the aggregated result from revealing information about any individual in the training data.

• Local DP: Clients can add DP noise to their updates before applying the Secure Aggregation mask. The server sums the noisy, masked vectors; the masks cancel, revealing the DP-protected aggregate.
• Central DP: Alternatively, the server can add DP noise to the unmasked aggregate after Secure Aggregation completes. This often provides a better utility-privacy trade-off but requires trust that the server will correctly add the noise.
• Layered Defense: Using both provides a defense-in-depth strategy, protecting against both a curious server and inference attacks on the final model.

Standard Secure Aggregation assumes honest-but-curious participants. It is not inherently robust to Byzantine clients who send malicious, arbitrary updates to sabotage the global model.

• Vulnerability: A Byzantine client can send a massively scaled update, and because masks cancel, its malicious contribution will directly affect the aggregate.
• Mitigation Strategies: Byzantine robustness must be added as a separate layer:
  • Robust Aggregation Rules: The server can use techniques like median or trimmed mean on the masked updates before summing, though this requires careful design to not break the masking scheme.
  • Verifiable Contributions: Clients can provide cryptographic proofs that their updates were computed correctly on valid data, though this is complex and costly.
• Active Area of Research: Designing efficient, Byzantine-robust secure aggregation protocols is a key challenge for high-stakes deployments.

A rigorous mathematical framework that provides a quantifiable privacy guarantee. It ensures the output of a computation (like a model update) is statistically indistinguishable whether any single individual's data is included or excluded. In federated learning, DP is often applied by adding calibrated noise to client updates before aggregation.

• Key Property: Bounds the maximum influence any single data point can have on the aggregate output.
• Relation to Secure Aggregation: Secure Aggregation provides a computational privacy guarantee for the aggregation step, while DP provides a statistical privacy guarantee for the final model, protecting against inference from the aggregated result itself. They are often used together for layered defense.

A form of encryption that allows computations to be performed directly on encrypted data. The encrypted result, when decrypted, matches the result of the operations performed on the plaintext. In federated learning, clients can encrypt their model updates with HE before sending them to the server.

• Core Mechanism: Enables the server to aggregate encrypted updates into an encrypted global update without ever decrypting individual contributions.
• Comparison to Secure Aggregation: Both enable privacy-preserving aggregation. HE is a cryptographic tool that can be used to implement Secure Aggregation. However, HE is often computationally intensive, while Secure Aggregation protocols like those based on Secure Multi-Party Computation may offer better practical efficiency for the specific sum operation.

A cryptographic protocol that enables multiple parties to jointly compute a function over their private inputs while revealing nothing beyond the final output. It's the foundational theory behind many practical Secure Aggregation schemes.

• Core Principle: No single party learns another party's private input, only the agreed-upon function result (e.g., the sum of model updates).
• Implementation Example: A common MPC-based Secure Aggregation protocol uses secret sharing and masking. Each client splits its update into secret shares distributed among other clients or the server, and uses cryptographic masks that cancel out when all masked updates are summed, revealing only the aggregate.

The property of a distributed system to tolerate a fraction of participants that behave arbitrarily—maliciously or due to faults—without corrupting the system's output. In federated learning, this means the global model should be resilient to clients submitting corrupted or adversarial updates.

• Adversarial Model: Assumes some clients may be Byzantine, sending arbitrary values to disrupt training.
• Interaction with Secure Aggregation: Secure Aggregation protects privacy but does not inherently provide Byzantine robustness. A malicious client can still submit a well-formed but poisonous update. Therefore, robust aggregation rules (like median-based or trimmed mean) must often be combined with Secure Aggregation to defend against poisoning attacks while maintaining privacy.

A secure, isolated area within a main processor (e.g., Intel SGX, ARM TrustZone) that guarantees code and data loaded inside are protected with respect to confidentiality and integrity. It creates a hardware-based 'black box' for computation.

• Core Guarantee: Even the host operating system or cloud provider cannot inspect or tamper with the code/data inside the TEE.
• Alternative to Cryptographic Aggregation: Secure Aggregation can be implemented by having clients send their encrypted updates to a server-side TEE. The TEE decrypts the updates, performs the aggregation, and outputs only the final sum. This shifts trust from the server's software stack to the hardware manufacturer's security guarantees.

The foundational algorithm for Federated Learning, where a central server periodically aggregates the model updates from participating clients to form a new global model. It is the most common function for which Secure Aggregation is applied.

• Standard Process: 1) Server broadcasts global model. 2) Clients train locally. 3) Clients send model updates (weight deltas or gradients). 4) Server averages the updates.
• Privacy Vulnerability: In vanilla FedAvg, the server receives each client's raw update in step 3, creating a privacy risk. Secure Aggregation is applied directly to step 3 and 4, allowing the server to compute the average (a function of the sum) without inspecting any individual client's contribution, making FedAvg privacy-preserving.