Secure Aggregation

The central server learns nothing beyond the aggregated sum of all client updates. Individual model gradients remain completely hidden from the server, other clients, and any passive network eavesdropper. This is typically achieved through pairwise additive masking, where each pair of clients agrees on a shared secret mask that cancels out during the final summation. Even if the server is honest-but-curious, it cannot perform a gradient leakage attack to reconstruct a single user's private training data.

The protocol must complete successfully even if a significant fraction of clients disconnect or fail mid-round. This is handled via Shamir's Secret Sharing (t-out-of-n threshold scheme). When a client sends a masked update, it also secret-shares its private key with all other clients. If a client drops out before revealing its mask, a quorum of surviving clients can reconstruct the missing key to remove the orphaned mask from the sum. This prevents a single straggler from blocking the entire round.

A malicious client could attempt to corrupt the global model by submitting arbitrarily large or malformed updates. Secure aggregation must be combined with cryptographic commitment schemes or zero-knowledge range proofs to verify that a client's masked update is well-formed without revealing the update itself. This ensures that a single Byzantine participant cannot poison the aggregated result, maintaining the correctness of the computed sum.

The compromise of a client's long-term key should not retroactively expose the private updates sent in previous rounds. This is enforced by generating ephemeral key pairs for each aggregation round. The Diffie-Hellman key agreement used for pairwise masking is performed with fresh randomness every time, ensuring that historical protocol transcripts remain secure even if a device is later physically compromised.

A naive secure aggregation protocol would require O(n²) communication complexity. Modern implementations reduce this to sub-linear or constant overhead per client using techniques like secret sharing with a sparse random graph or a federated averaging server that acts as a relay. This property is critical for scaling to cross-device federated learning scenarios involving millions of mobile phones where bandwidth and battery life are constrained.

If the central server is actively compromised during an aggregation round, it should not be able to recover individual updates from that round. This is achieved by ensuring the server only ever sees masked inputs. The masks are only removed by the server after it has summed all contributions. A server breach mid-computation yields only a set of random-looking, individually useless masked vectors, not the raw gradients.

A cryptographic method by which a client can prove to the aggregation server that their model update is well-formed and honestly computed without revealing the update itself. This prevents malicious clients from submitting poisoned or arbitrarily large values that could corrupt the global model.

• zk-SNARKs: Succinct, non-interactive proofs with a trusted setup phase.
• zk-STARKs: Scalable, transparent proofs that do not require a trusted setup.
• Range Proofs: A specific ZKP used to prove a value lies within a certain range without disclosing the value.