Secure Multi-Party Computation (MPC)

The primary guarantee of MPC. No party learns anything about another party's private input beyond what can be inferred from the protocol's final output. This is formalized using simulation-based security proofs, which demonstrate that a party's view of the protocol (its input, randomness, and received messages) can be simulated using only its own input and the final output, implying no extra information is leaked.

• Example: In a secure aggregation for federated learning, the server learns only the sum of model updates, not any individual client's gradient vector.
• Security Models: This property holds under different adversarial assumptions, such as the honest-but-curious (semi-honest) or malicious models.

The protocol ensures that the computed output is accurate according to the specified function, provided all parties follow the protocol. In the presence of malicious adversaries who may deviate arbitrarily, MPC protocols employ verifiability mechanisms (like zero-knowledge proofs or Message Authentication Codes) to guarantee that the final result is equivalent to having correctly executed the function on the valid inputs.

• Contrast with Integrity: While integrity ensures the output isn't tampered with, correctness ensures it's the right output of the intended computation.
• Robustness: A stronger property where the protocol terminates with the correct output even if some parties abort or send invalid messages, up to a defined threshold.

A party's input to the computation must be chosen independently of the inputs of other parties. This prevents adaptive attacks where a malicious party waits to see others' commitments or messages before choosing its own input, which could leak information or corrupt the result. Protocols enforce this through commitment schemes in initial rounds, binding each party to their input before the core computation begins.

The protocol is designed to complete and deliver the output to all honest participants, even if some parties drop out (fail-stop) or are malicious. This is not a given in all MPC designs; some may only offer fairness (if one party gets the output, all do) or allow abort. Guaranteed output delivery is critical for robust systems like federated learning, where client devices are unreliable. It is often achieved through techniques like secret sharing with redundancy and error-correcting codes.

A high-security framework property stating that an MPC protocol remains secure even when run concurrently with other arbitrary protocols or multiple instances of itself. A Universally Composable (UC) secure protocol guarantees security in complex, real-world environments. This is the gold standard for cryptographic proofs and is essential for protocols intended as building blocks in larger systems, ensuring security is maintained when integrated with other components like key agreement or secure channels.

While a theoretical property, practical deployment hinges on efficiency. MPC protocols are characterized by their round complexity (number of back-and-forth messages), communication overhead (total data sent), and computational cost (crypto operations per party).

• Constant-round protocols are vital for high-latency networks.
• Communication often scales with the number of parties (O(n^2) in naive designs) or circuit size.
• Techniques for Improvement: Use of preprocessing (offline phase), pairwise masking (as in the Bonawitz Protocol), and efficient homomorphic encryption or secret sharing schemes.

A specific cryptographic protocol used in federated learning that allows a central server to compute the sum of client model updates (e.g., gradients) without learning any individual client's contribution. It is a direct application of MPC principles to the federated learning setting.

• Core Mechanism: Often uses pairwise masking or additive secret sharing.
• Key Property: Provides input privacy for clients against a curious central server.
• Example: The Bonawitz Protocol is a widely cited secure aggregation scheme designed to be efficient and tolerant of client dropouts during the aggregation round.

A form of encryption that allows specific computations to be performed directly on ciphertext. The encrypted result, when decrypted, matches the result of operations performed on the plaintext. It enables a party to compute on encrypted data without needing the decryption key.

• Types: Partially Homomorphic Encryption (PHE) supports one operation (e.g., addition). Fully Homomorphic Encryption (FHE) supports both addition and multiplication, enabling arbitrary computations.
• Use Case: In MPC, a client can encrypt their data and send it to a server; the server performs computations on the encrypted data and returns the encrypted result, which only the client can decrypt.
• Example Scheme: The Paillier cryptosystem is an additive homomorphic encryption scheme commonly used for secure summation.

A rigorous mathematical framework for quantifying and limiting the privacy loss incurred by an individual when their data is included in a statistical analysis or machine learning model. It provides a strong, statistical guarantee of privacy.

• Core Mechanism: Adds carefully calibrated noise (e.g., via the Gaussian Mechanism or Laplace Mechanism) to the output of a computation.
• Privacy Budget: Measured by epsilon (ε); a smaller ε signifies stronger privacy but potentially less accurate results.
• Synergy with MPC: Often combined with MPC. MPC can securely compute an aggregate, and differential privacy can then be applied to the aggregate before release, providing a layered defense.

A fundamental cryptographic technique where a secret value (e.g., a model update) is split into multiple shares that are distributed among participants. The original secret can only be reconstructed by combining all shares; any subset reveals zero information about the secret.

• Mathematical Basis: A secret s is split into shares s1, s2, ..., sn such that s = s1 + s2 + ... + sn modulo some integer.
• MPC Role: Serves as a core building block for many MPC protocols. Parties perform local computations on their shares, and only the final, recombined result reveals the output.
• Contrast with Threshold Schemes: Unlike Shamir's Secret Sharing, additive sharing typically requires all shares to reconstruct.

A secure, isolated area within a main processor (CPU) that guarantees the confidentiality and integrity of code and data loaded inside it. Code executed in a TEE is protected even from a compromised operating system or hypervisor.

• Hardware-Based Isolation: Provides a strong alternative or complement to purely cryptographic MPC.
• Use Case: In federated learning, client data can be processed inside a TEE (an enclave) on the server, ensuring the raw data is never exposed to the server's software stack.
• Example: Intel Software Guard Extensions (SGX) is a widely implemented TEE technology. ARM TrustZone is another common example.

A class of algorithms designed for securely aggregating model updates in distributed or federated learning that are resilient to malicious clients. These clients may send arbitrary, adversarial updates designed to corrupt the global model (data poisoning).

• Threat Model: Defends against the malicious adversary model, where participants can arbitrarily deviate from the protocol.
• Techniques: Includes robust statistical estimators like coordinate-wise median, trimmed mean, or Krum, which identify and filter out outlier updates.
• Relationship to MPC: While MPC ensures privacy, Byzantine robustness ensures correctness in the presence of active attackers. They are complementary defenses often used together.