Secure Aggregation

The fundamental operation of Secure Aggregation is the privacy-preserving summation of client vectors. Using cryptographic techniques like pairwise masking or homomorphic encryption, individual client updates are obfuscated. When the server sums all received masked updates, the masks cancel out, revealing only the aggregated model update (e.g., the sum of gradients) while keeping each client's raw data contribution completely hidden from the server and other participants.

A critical feature for real-world federated learning is dropout tolerance. Clients on mobile devices or edge networks can disconnect unexpectedly. A robust Secure Aggregation protocol must correctly compute the sum even when a subset of clients fails to submit their masked updates. Protocols like the Bonawitz Protocol achieve this by structuring masks so they cancel out only when all intended clients contribute; if a client drops, the server can work with a subset of clients to reconstruct the necessary secrets and still compute the correct aggregate, preventing data loss from disconnections.

Many Secure Aggregation protocols provide information-theoretic security against honest-but-curious adversaries. This means that, assuming participants follow the protocol, no coalition of clients or the server can learn anything about an individual client's update beyond what is inferable from the final aggregate. This security guarantee does not rely on unproven computational assumptions, making it robust against future advances in computing, such as quantum attacks. It is typically achieved through secret sharing and masking schemes.

For deployment on resource-constrained edge devices, Secure Aggregation must be communication and computationally efficient. Unlike naive homomorphic encryption, which can be prohibitively slow, efficient protocols use lightweight symmetric cryptography and masking. Key techniques include:

• One-time masks generated via a key agreement protocol (e.g., Diffie-Hellman).
• Compression of model updates before masking.
• Batched operations to minimize network round trips. These optimizations ensure the overhead of privacy does not cripple the federated learning process.

Secure Aggregation is often combined with Differential Privacy (DP) to provide a layered privacy guarantee. While Secure Aggregation hides individual updates from the server, DP protects against inference from the final aggregated model. A common pattern is:

1. Each client clips their local update to bound its sensitivity.
2. Clients apply Secure Aggregation to submit their clipped updates.
3. The server adds a small amount of calibrated noise (e.g., using the Gaussian mechanism) to the secure aggregate before updating the global model. This combination defends against a broader range of privacy attacks.

Advanced Secure Aggregation schemes incorporate Byzantine robustness to tolerate malicious clients who send arbitrary or adversarial updates to corrupt the global model. This goes beyond the honest-but-curious model. Robust techniques include:

• Outlier detection on masked contributions.
• Verifiable secret sharing to ensure clients submit valid shares.
• Redundant aggregation using robust estimators like the median or trimmed mean after unmasking. This feature is essential for open participation federated learning where client behavior cannot be fully trusted.

Algorithms designed to securely aggregate model updates in the presence of a bounded number of malicious (Byzantine) clients. These clients may send arbitrary, adversarial updates to corrupt the global model.

• Threat Model Extension: Secure Aggregation typically assumes honest-but-curious adversaries. Byzantine Robust Aggregation defends against actively malicious ones.
• Techniques: Includes coordinate-wise median, trimmed mean, and Krum aggregation, which filter out statistical outliers in the update vectors before averaging.
• Challenge: Must be compatible with cryptographic privacy measures, as filtering requires inspecting update values.

The core cryptographic technique used in the Bonawitz Protocol (the canonical Practical Secure Aggregation scheme). Each client adds a secret mask to their model update, structured so all masks cancel out upon summation.

• Mechanism: Each client pair agrees on a random seed. They generate identical pseudorandom masks, which one client adds and the other subtracts. In the sum, these pairwise masks cancel perfectly.
• Dropout Tolerance: The protocol includes a mechanism for the server to efficiently reconstruct the masks of dropped-out clients, ensuring the final sum is unmasked correctly.
• Efficiency: Avoids the heavy computation of homomorphic encryption, making it suitable for large model updates.