Privacy-Preserving Selection

Secure Multi-Party Computation (MPC) is a cryptographic protocol that allows multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. In client selection, MPC enables a set of clients or auxiliary servers to collaboratively determine the selected cohort based on private criteria (e.g., data size, gradient norm) without any single entity learning the individual inputs or the final selection list.

• Key Mechanism: Uses secret sharing or garbled circuits to perform computations on encrypted or distributed data shares.
• Privacy Guarantee: Provides information-theoretic or cryptographic security, meaning privacy is guaranteed even against computationally unbounded adversaries (in information-theoretic MPC).
• Example Application: A committee of clients uses MPC to compute which among them have the largest local loss values, selecting the top-K for the round without any client learning another's loss.

Differential Privacy (DP) for Selection applies the principles of differential privacy to the client selection mechanism itself. It ensures that the inclusion or exclusion of any single client's metadata from the selection algorithm does not significantly affect the probability distribution of the selected cohort, thereby protecting client participation privacy.

• Key Mechanism: Introduces calibrated noise (e.g., from the Exponential or Laplace mechanism) into the selection process. Common methods include the Report Noisy Max algorithm, where noise is added to client utility scores before selection.
• Privacy Guarantee: Provides a quantifiable, mathematically rigorous privacy bound expressed as (ε, δ)-Differential Privacy.
• System Impact: The added randomness can slightly reduce selection efficiency (e.g., sometimes choosing a sub-optimal client) in exchange for a formal privacy guarantee.

Private Information Retrieval (PIR) is a cryptographic protocol that allows a client to retrieve an item from a database held by a server without the server learning which item was retrieved. In federated learning selection, this can be inverted: the server can retrieve a client's eligibility or utility score from a client-held database without the client learning which score was accessed, enabling private eligibility checks.

• Key Mechanism: Uses homomorphic encryption or database preprocessing to allow query execution on encrypted indices. Single-server PIR relies on computational assumptions, while multi-server PIR can offer information-theoretic security.
• Use Case: A server can privately check if a client's data size exceeds a threshold by performing a PIR query on a client's locally stored metadata vector, learning only the Boolean result, not the actual size.

A Federated Coreset is a small, weighted synthetic dataset that approximates the overall data distribution across all clients. When combined with Differential Privacy (DP), the process of creating and querying this coreset for selection guidance can be made privacy-preserving.

• Key Mechanism: Clients generate DP-sanitized summaries or synthetic data points representing their local distribution. The server aggregates these into a global DP coreset. Selection decisions (e.g., which data distributions are underrepresented) are made by analyzing the coreset, not by directly inspecting client metadata.
• Privacy Benefit: Protects the specific data statistics of any individual client. The server only sees noised, aggregated synthetic data.
• Advantage: Enables data-aware selection strategies (like stratified sampling) without direct access to private client data distributions.

Trusted Execution Environments (TEEs), such as Intel SGX or AMD SEV, provide hardware-isolated, encrypted memory regions (enclaves) for secure computation. In blind selection, the client selection logic and sensitive metadata are executed inside a TEE on the server.

• Key Mechanism: Client metadata is sent to the server encrypted and can only be decrypted inside the secure TEE enclave. The selection algorithm runs within the enclave, and only the final, encrypted list of selected client IDs is output.
• Privacy Guarantee: Relies on hardware security to ensure the server's operating system or administrators cannot observe the metadata or the selection process.
• Trust Model: Requires trust in the hardware manufacturer and the enclave's attestation mechanism, but not in the server software stack.

Private Set Intersection (PSI) is a cryptographic protocol that allows two parties to compute the intersection of their private sets without revealing any elements outside the intersection. In selection, it can privately determine which clients from a pool are eligible based on a server-held criteria set.

• Key Mechanism: The server has a set of client IDs that meet certain public criteria (e.g., online status). Each client has its own ID. A PSI protocol is run to discover the intersection—the eligible clients—without the server learning the full client pool or clients learning the server's eligibility list.
• Application: Useful in cross-silo settings where the total client set is sensitive. It enables the server to privately discover which silos (e.g., hospitals) are available for a training round without learning the identities of all potential silos in the network.

In cross-institutional medical imaging, hospitals collaborate to train a model for detecting rare conditions. Privacy-preserving selection ensures that the coordinating server cannot infer which hospitals have the largest datasets of a specific disease (a sensitive competitive and patient privacy indicator) when selecting participants for a training round. Techniques like secure multi-party computation (MPC) allow hospitals to compute a joint utility score (e.g., based on data relevance) without revealing individual scores.

Banks federating a model to detect novel fraud patterns must protect client metadata. A bank's recent spike in fraud attempts or the volume of its transaction data is highly confidential. A differentially private selection mechanism adds calibrated noise to utility metrics (like client loss or data size) before the server uses them for ranking. This prevents the server from confidently identifying which bank is experiencing an attack or has the most valuable data, while still biasing selection toward useful participants.

For federated learning on personal devices (e.g., smartphones for next-word prediction), the server should not learn a user's typing activity patterns. Selection based on device availability or local data freshness could reveal a user's daily routine. Private information retrieval (PIR) or homomorphic encryption (HE)-based protocols enable the server to select clients whose metadata matches certain criteria (e.g., 'device is charging') without learning which specific clients satisfy it or the exact value of their metadata.

Manufacturers with fleets of machinery use federated learning to predict failures. The operational health data (vibration, temperature) and failure frequency of a specific factory line are trade secrets. Privacy-preserving selection prevents the central aggregator from identifying which factories are most at risk (a signal of potential production issues). Federated Coreset-based methods allow factories to submit encrypted, weighted synthetic data summaries; the server selects participants based on these encrypted proxies without decrypting the underlying sensitive statistics.

Competing enterprises in the same sector (e.g., retail) may collaborate on a demand forecasting model without sharing customer data. The size of each company's dataset for a specific product category is a key business intelligence metric. A secure multi-party computation (MPC) auction can be used where each company privately bids a utility value for participation. An MPC protocol selects the top-k bidders without revealing any bid values to the server or other participants, ensuring no leakage of relative data scale.

These cryptographic and algorithmic primitives form the backbone of privacy-preserving selection:

• Secure Multi-Party Computation (MPC): Enables multiple parties to jointly compute a function (e.g., argmax for selection) over their private inputs without revealing those inputs.
• Differential Privacy (DP): Adds mathematically calibrated noise to client-reported metadata (e.g., loss, data size) before selection, providing a quantifiable privacy guarantee.
• Homomorphic Encryption (HE): Allows the server to perform computations (comparisons, rankings) on encrypted client metadata, producing an encrypted result that only authorized parties can decrypt.
• Private Information Retrieval (PIR): Lets a client fetch an item from a server-held database without the server learning which item was retrieved, useful for private cohort assignment.