Honest-but-Curious Adversary

An Honest-but-Curious adversary is bound by the rule that they must follow the prescribed protocol exactly. They cannot:

• Send incorrect or malformed messages.
• Refuse to send required messages.
• Collude with other parties in ways not defined by the protocol.

This distinguishes them from a Malicious Adversary, who can arbitrarily deviate. The HbC model is often the first, more tractable security goal for designing complex protocols like Secure Multi-Party Computation (MPC) or Secure Aggregation.

The adversary's threat is post-hoc analysis. After correctly executing their role, they record all protocol transcripts—every message sent and received—and apply unlimited computational power to infer secrets. For example, in a federated learning round, an HbC central server would correctly aggregate updates but might try to reverse-engineer an individual client's private training data from their model gradient. This makes defenses like additive secret sharing and pairwise masking essential, as they ensure the aggregated result reveals nothing about individual inputs.

The HbC model provides a well-defined, cryptographically rigorous framework for proving security. A protocol proven secure against HbC adversaries guarantees that no additional information is leaked beyond the protocol's intended output. This is typically proven via a simulation-based security argument: if anything an adversary learns can be simulated without access to private inputs, then the protocol is secure. This foundational proof is often a prerequisite before adding robustness against stronger, malicious adversaries.

The model is considered a practical and realistic threat assumption for many enterprise and regulated environments. It models parties who have an incentive to follow the protocol (e.g., to maintain a service contract or comply with regulation) but also have an incentive to learn extra information (e.g., for competitive intelligence). It is frequently assumed in privacy-preserving machine learning architectures, including federated learning, where participants (hospitals, banks) are trusted to run code correctly but not to share raw data.

Security against HbC adversaries does not guarantee robustness against active attacks. Key limitations include:

• No protection against data poisoning: A malicious client could submit corrupted model updates.
• No protection against denial-of-service: Clients may simply drop out.
• Vulnerability to protocol deviations.

Therefore, for high-stakes deployments, protocols are often later strengthened to resist Malicious Adversaries or Byzantine failures, which are more complex and computationally expensive to defend against.

In Federated Learning, the central server is often treated as an Honest-but-Curious party. Secure Aggregation protocols like the Bonawitz Protocol are explicitly designed for this model. They allow the server to compute the sum of client updates (e.g., for Federated Averaging) without being able to inspect any single client's contribution. The server follows the aggregation steps correctly but is prevented from learning individual values through cryptographic techniques like masking with key agreement and dropout tolerance.

Additive Homomorphic Encryption is an encryption scheme where performing an operation (like addition) on ciphertexts produces a new ciphertext that, when decrypted, equals the sum of the corresponding plaintexts. This is ideal for honest-but-curious aggregation.

• Core Mechanism: Enables a server to compute the sum of encrypted client updates without ever decrypting them individually.
• Primary Use Case: The foundation for many secure aggregation protocols in federated learning.
• Example Schemes: The Paillier cryptosystem is a widely used public-key scheme offering additive homomorphism.
• Limitation: Typically supports only addition, not arbitrary computations, making it efficient for specific aggregation tasks.

Secret Sharing is a method for distributing a secret among a group of participants, where each is allocated a share. The secret can only be reconstructed when a sufficient number of shares are combined. Under honest-but-curious assumptions, individual shares reveal zero information about the secret.

• Threshold Schemes: Shamir's Secret Sharing is a common (t, n)-threshold scheme where any 't' of 'n' shares can reconstruct the secret.
• Application in Secure Aggregation: A client's model update can be split into shares sent to multiple servers. The sum of updates is computed across shares, and no single server sees any client's full contribution.
• Verifiable Secret Sharing (VSS): An extension that allows participants to verify the validity of their shares, adding robustness against a malicious dealer, even in a semi-honest participant model.

Differential Privacy provides a mathematically rigorous guarantee that the presence or absence of any single individual's data in a dataset has a negligible effect on the output of an analysis. When applied locally, it defends against honest-but-curious aggregators.

• Local Model: In Local Differential Privacy, each client perturbs its data locally before sending it to the server. The server sees only noisy data, providing privacy even if the server is curious.
• Common Mechanisms:
  • Laplace Mechanism: Adds noise drawn from a Laplace distribution to numerical outputs.
  • Gaussian Mechanism: Adds Gaussian noise, often used when the output is a high-dimensional vector like a gradient.
• Privacy Budget (ε): Governs the privacy-utility trade-off. A smaller epsilon (ε) means stronger privacy but noisier results.

The Bonawitz Protocol (often termed Practical Secure Aggregation) is a specific cryptographic protocol designed for federated learning that provides secure aggregation under the honest-but-curious server model with dropout tolerance.

• Core Technique: Uses pairwise masking via a key agreement protocol (like Diffie-Hellman). Each client adds a secret mask to its update, shared with another client. When all clients submit updates, the masks cancel out in the sum.
• Dropout Resilience: If a client drops out, its pairwise mask cannot be canceled. The protocol uses a trusted third party or secret sharing to a committee of servers to recover the necessary masking keys.
• Security Guarantee: The central server learns only the aggregated model update, not any individual contribution, as long as clients follow the protocol and do not collude.

A Trusted Execution Environment is a secure, isolated area within a main processor (e.g., an Intel SGX enclave) that guarantees code integrity and data confidentiality. It can enforce honest-but-curious execution by design.

• How it Works: Sensitive code (e.g., aggregation logic) runs inside the TEE. Even the host operating system or cloud provider cannot observe or tamper with the data being processed.
• Use Case: A federated learning server can run inside a TEE. Clients encrypt their updates for the TEE's specific key. The TEE decrypts, aggregates, and outputs only the final model, with the internal process hidden from the curious server operator.
• Trust Assumption: Shifts trust from the entire server software stack to the hardware manufacturer's implementation of the TEE and the remote attestation process.

A stronger security model where participants can arbitrarily deviate from the protocol specification. Unlike an Honest-but-Curious adversary, a malicious adversary can:

• Send incorrect or fabricated messages.
• Drop out of the protocol mid-execution.
• Collude with other participants.

Protocols secure against malicious adversaries are significantly more complex and computationally expensive but provide guarantees against active sabotage.

A cryptographic subfield that enables multiple parties to jointly compute a function over their private inputs while revealing only the final output. MPC protocols are often designed to be secure against specific adversary models, including Honest-but-Curious.

Key Property: Privacy is maintained even if some participants are curious about others' data. MPC is the theoretical foundation for many privacy-preserving techniques, including secure aggregation in federated learning.

A rigorous mathematical framework for quantifying and limiting privacy loss. It provides a guarantee that the inclusion or exclusion of any single individual's data has a negligible effect on the algorithm's output.

Relation to HBC: While HBC defines who might try to learn (a protocol-following participant), Differential Privacy provides a mechanism to mathematically bound what they can learn, even if they have access to aggregated results. They are often used in tandem.

A secure, isolated area within a main processor (e.g., Intel SGX, ARM TrustZone) that guarantees the confidentiality and integrity of code and data loaded inside it.

Alternative to Cryptographic Protocols: A TEE can be used to create a trusted aggregator, effectively reducing the threat model. The server is assumed to be honest inside the enclave, even if the host OS is compromised. This shifts trust from pure cryptography to hardware security, offering a different trade-off for mitigating curious adversaries.

Algorithms designed for secure aggregation in the presence of malicious clients. While HBC adversaries only observe, Byzantine clients can actively corrupt their updates.

Examples: Krum, Median, and Trimmed Mean are aggregation rules that filter out statistical outliers. These techniques are often layered on top of secure aggregation protocols to defend against a stronger threat model that includes both curious and malicious actors.

A cryptographic protocol where one party (the prover) can prove to another (the verifier) that a statement is true without revealing any information beyond the statement's validity.

Application to HBC: In federated learning, a client could use a ZKP to prove to the server that their local update was computed correctly (e.g., on valid, non-poisoned data) without revealing the update itself. This enhances verifiability within the semi-honest model, ensuring participants are not just curious but also correctly following the computational steps.