Secure Multi-Party Computation (MPC)

The cardinal property of MPC. It guarantees that no party learns anything about another party's private input beyond what can be inferred from the final output of the function. This is formalized using simulation-based security: for any adversary's view of the protocol, a simulator could have generated an indistinguishable view using only the party's own input and the final output. This holds even if parties collude, up to a defined threshold (e.g., honest majority).

• Example: In a private salary comparison, two employees learn only who has the higher salary, not the exact figure of the other.

Ensures that the protocol computes the exact function specified by the participants. All honest parties are guaranteed to receive the correct output, provided a sufficient number of participants follow the protocol (e.g., an honest majority). This property protects against both accidental errors and malicious attempts to corrupt the computation.

• Mechanisms: Achieved through verifiable secret sharing and commitment schemes that allow parties to prove they are following the protocol steps correctly without revealing secrets.

Guarantees that parties must commit to their inputs before learning anything about the inputs of others. This prevents an adversarial party from choosing their input as a function of another's, which could leak information or manipulate the result.

• Critical for: Auctions, voting, and any scenario where inputs should be sealed. Protocols often use an input commitment phase where inputs are cryptographically locked in before computation proceeds.

Ensures that if one party receives the output of the computation, all honest parties receive the output. This prevents a situation where a malicious party learns the result and then aborts the protocol, leaving others without the answer. Achieving perfect fairness is challenging and often requires strong assumptions (like a trusted third party for dispute resolution).

• Weaker Guarantee: Many practical protocols provide fairness with abort, where the protocol either completes correctly for all or aborts for all, preventing the adversary from being the sole beneficiary.

A stronger property than fairness, ensuring that all honest parties will always receive the output, regardless of malicious behavior by other participants. This makes the protocol robust against denial-of-service attacks from malicious parties who refuse to participate in final steps.

• Trade-off: Guaranteed output delivery typically requires more rounds of communication and stronger trust assumptions (e.g., a two-thirds honest majority) compared to protocols that allow abort.

MPC protocols are designed under specific adversarial models that define the attacker's capabilities.

• Semi-Honest (Passive) Adversaries: Parties follow the protocol but may try to learn extra information from the message transcripts. Provides privacy but not correctness against active cheating. More efficient.
• Malicious (Active) Adversaries: Parties may deviate arbitrarily from the protocol (e.g., send wrong values, abort). Provides stronger correctness and fairness guarantees but with significant computational and communication overhead.

Most advanced protocols (e.g., SPDZ, BGW) offer security against malicious adversaries.

A cryptographic protocol that allows two or more parties, each holding a private set of items, to compute the intersection of their sets without revealing any information about items not in the intersection. This is a critical pre-processing step in many MPC and federated learning workflows.

• Use Case in MPC/FL: In Vertical Federated Learning, where parties hold different features for the same (or overlapping) users, PSI is used to securely align the common user IDs across databases before joint model training begins, without exposing the full user lists.

A specific cryptographic protocol, often built using MPC primitives, used extensively in Federated Learning. It allows a central server to compute the sum of client model updates (e.g., gradient vectors) without being able to inspect any individual client's contribution.

• Mechanism: Clients often encrypt their updates with pairwise masking secrets that cancel out when summed across all clients. The server only sees the aggregated, masked result. This protects client data from a curious-but-honest server and from other clients.