Federated Learning Security

A cryptographic protocol that allows a central server to compute the sum of model updates from multiple clients without being able to inspect any individual client's contribution. This prevents the server from performing a model inversion attack to infer sensitive details from a single update. The protocol typically uses masking with secret shares, where clients add cryptographic masks to their updates that cancel out when all masked updates are summed, revealing only the aggregate. This is a foundational privacy guarantee in federated learning.

A mathematical framework that provides a quantifiable privacy guarantee by adding calibrated statistical noise to data or computations. In federated learning, noise (often from a Laplace or Gaussian distribution) is typically added to individual model updates before they leave the client device or to the aggregated global model. The key parameters are epsilon (ε) and delta (δ), which bound the probability that an adversary can determine if any single user's data was in the training set. This formally protects against membership inference attacks.

A form of encryption that enables computation on ciphertexts. In federated learning, clients can encrypt their model updates before sending them to the aggregator. The server can then perform the aggregation operation (addition) on the encrypted updates without decrypting them, returning an encrypted aggregate. Only a designated party holds the decryption key. While providing the strongest cryptographic privacy, it incurs significant computational and communication overhead, making it less practical for large models compared to secure aggregation.

Aggregation algorithms designed to tolerate malicious or faulty clients (Byzantine nodes) that send arbitrary, adversarial updates to corrupt the global model. Standard averaging (like FedAvg) is highly vulnerable to such attacks. Robust methods include:

• Coordinate-wise Median/Trimmed Mean: Discards extreme values for each model parameter.
• Krum/Multi-Krum: Selects the update vector most similar to its neighbors, excluding outliers.
• Bulyan: Applies Krum iteratively, then aggregates the remaining vectors with trimmed mean. These techniques ensure the global model converges correctly even when a fraction of clients are compromised.

Secure, isolated areas within a main processor (e.g., Intel SGX, ARM TrustZone) that guarantee confidentiality and integrity for code and data. In federated learning, the aggregation logic can run inside a TEE on the central server. Client updates are sent directly to this secure enclave, where they are decrypted and aggregated, invisible to the host operating system or cloud provider. This combines the privacy of local processing with the efficiency of centralized aggregation, without relying on complex cryptography for the aggregation step itself.

A protocol that allows a client to cryptographically verify the state of a remote server (or its TEE) before sending sensitive data. The server produces a signed report (attestation) of its hardware and software configuration, including the hash of the aggregation code running in its TEE. The client verifies this signature and hash against a known good value. This ensures the client is communicating with a genuine, untampered aggregation service, preventing man-in-the-middle attacks or malicious code masquerading as the aggregator.

A mathematical framework that adds calibrated statistical noise to data or model updates to prevent the inference of any individual's information. In federated learning, it is often applied to the aggregated model updates before they are shared with the central server.

• Key Property: Provides a quantifiable privacy guarantee, expressed as (ε, δ)-differential privacy.
• Trade-off: Introduces a fundamental tension between privacy and model utility; more noise increases privacy but can reduce accuracy.
• Example: The Apple Private Federated Learning system uses differential privacy in its crowd-sourced learning processes.

A cryptographic protocol that enables multiple parties (e.g., edge devices) to jointly compute a function (like an average of model updates) over their private inputs while keeping those inputs secret from each other.

• Core Mechanism: Uses secret sharing, where each participant's data is split into encrypted shares distributed among other participants. The computation occurs on these shares.
• Application in FL: Enables secure aggregation where the server learns only the final aggregated model update, not the individual contributions from any single device.
• Limitation: Can introduce significant communication and computational overhead compared to non-secure aggregation.

A class of aggregation algorithms designed to tolerate malicious or faulty participants (Byzantine nodes) that may send arbitrary, adversarial updates to corrupt the global model.

• Goal: Ensure the aggregated global model update approximates the true update from honest participants, even when up to a certain fraction are malicious.
• Common Techniques: Include coordinate-wise median, trimmed mean, and Krum, which identify and exclude statistical outliers in the update vectors.
• Critical Need: Essential for open or semi-trusted federated networks where device compromise is a realistic threat.

A security protocol that allows a trusted verifier (e.g., the central aggregator) to cryptographically confirm the integrity of the software and hardware state on a remote client device.

• Process: The device generates a cryptographically signed report of its measured software (e.g., the federated learning client code) and hardware configuration, which is verified against a known-good policy.
• Use in FL: Verifies that client devices are running the correct, un-tampered training code before their updates are accepted, preventing malware from poisoning the model.
• Foundation: Often relies on a hardware Root of Trust like a Trusted Platform Module (TPM) or a Trusted Execution Environment (TEE).

A form of encryption that allows specific types of computations (e.g., addition, multiplication) to be performed directly on encrypted data, yielding an encrypted result that, when decrypted, matches the result of operations on the plaintext.

• Application in FL: Clients can encrypt their model updates before sending them. The server can perform aggregation operations on the ciphertext, and only the final aggregated result is decrypted.
• Key Benefit: The central server never sees individual plaintext model updates, providing strong confidentiality.
• Challenge: Fully Homomorphic Encryption (FHE) is computationally intensive, making it often impractical for large models; Partially Homomorphic Encryption (PHE) supporting only addition is more commonly used for secure aggregation.

The integration of security practices into the machine learning operations (MLOps) lifecycle, specifically applied to securing federated learning pipelines, models, and data against adversarial threats.

• Scope: Encompasses Threat Modeling for FL architectures, automated security testing of aggregation protocols, monitoring for anomalous update patterns (data poisoning), and managing cryptographic key lifecycles.
• Key Practices: Maintaining a Software Bill of Materials (SBOM) for client software, implementing Secure OTA Updates for the federated client, and continuous Runtime Integrity Verification.
• Goal: To operationalize the principles of Security by Design within the unique, decentralized context of federated learning.