Secure Aggregation

The foundational cryptographic primitive that prevents the server from inspecting individual updates. Each client generates a random one-time mask for every other client in the cohort.

• Clients add their secret mask to their model update before transmission
• Paired masks cancel out during the final summation: mask_AB + mask_BA = 0
• The server only sees a blinded, unintelligible value until all shares are combined
• Relies on Diffie-Hellman key agreement for pairwise mask generation

This ensures the server cannot unmask any single contribution even if it inspects all incoming messages.

A critical practical property that allows the protocol to complete successfully even when a subset of clients disconnects or fails mid-round.

• Clients pre-generate t-out-of-n Shamir secret shares of their private keys
• If a client drops out, surviving clients reconstruct the missing mask using their shares
• The server can still compute the correct aggregate without the dropout's raw update
• Typical implementations tolerate up to 30% client dropout without restarting the round

This is essential for cross-device FL where mobile phones frequently lose connectivity.

Cryptographic mechanisms that allow the server to verify that clients are submitting well-formed updates without seeing the update contents.

• Zero-knowledge range proofs prove a vector's values lie within a valid range
• Commitment schemes bind clients to their updates before the masking round begins
• Prevents data poisoning attacks where malicious clients submit arbitrarily large values
• Ensures the aggregate sum is mathematically sound and not corrupted by outliers

This bridges the gap between privacy and Byzantine fault tolerance in the aggregation step.

The protocol's network efficiency is defined by the number of synchronous communication rounds required to complete one aggregation.

• Standard secure aggregation requires 4 rounds: advertise keys, share secrets, send masked updates, unmask
• Optimized variants reduce this to 2 rounds using pre-computed pseudorandom masks
• Each client communicates only with the server, never directly with other clients
• Total bandwidth per client scales as O(n + d) where n is cohort size and d is update dimension

Efficient round structure is critical for scaling to thousands of edge devices.

Forward-looking implementations address the threat of quantum computers breaking the discrete-logarithm assumptions underlying current masking protocols.

• Standard secure aggregation relies on Elliptic Curve Diffie-Hellman for key agreement
• A sufficiently powerful quantum computer running Shor's algorithm could retroactively decrypt recorded ciphertexts
• Research is active on lattice-based post-quantum secure aggregation using Ring-LWE assumptions
• Hybrid schemes combine classical and post-quantum primitives for transitional security

This is particularly relevant for genomic data which has a multi-decade sensitivity horizon.

Secure aggregation operates under a specific adversarial model that defines what the protocol protects against and what it explicitly does not.

• Honest-but-curious server: The server follows the protocol correctly but attempts to learn individual updates
• Active client adversaries: Malicious clients may submit arbitrary values or deviate from the protocol
• The protocol does not protect against the server inferring properties from the final aggregate itself
• Out-of-band authentication is required to prevent Sybil attacks where one entity controls many clients

Understanding these boundaries is essential for correct deployment in regulated genomic consortia.

A foundational cryptographic primitive where each client's model update is split into n secret shares using a threshold (t, n) scheme. The server can only reconstruct the aggregate sum when at least t shares are combined, ensuring no single party can inspect an individual contribution.

• Information-theoretic security: No computational assumptions required
• Dropout resilience: Survives up to n - t client failures
• Genomic context: Enables rare disease consortia where losing a hospital's update mid-round is common
• Overhead: Communication scales O(n²) per aggregation round

Each pair of clients agrees on a shared random seed to generate a masking vector. Client A adds the mask, Client B subtracts it. When all masked updates are summed, pairwise masks cancel out, revealing only the aggregate.

• Double-masking protocol: Adds a second mask for dropout recovery
• Efficiency: Communication scales O(n) rather than O(n²)
• Production use: Forms the cryptographic backbone of Google's Secure Aggregation protocol for cross-device FL
• Limitation: Requires all clients to be online simultaneously for key exchange

Secure aggregation alone prevents inspection of individual updates, but the aggregate model may still leak membership information. Combining secure aggregation with differential privacy adds calibrated Gaussian noise to the sum before it reaches the server.

• Local DP: Noise added by each client before masking
• Central DP: Noise added by a trusted aggregator after unmasking
• Privacy budget (ε): Typically set between 1 and 8 for genomic studies
• Trade-off: Higher ε improves model utility but weakens privacy guarantees

Rather than cryptographic masking, model updates are sent to a hardware-enclave (e.g., Intel SGX, AMD SEV) running inside the aggregator's server. The enclave decrypts updates, computes the sum, and outputs only the aggregate.

• Attestation: Clients verify enclave identity before transmitting
• Performance: Near-plaintext computation speed, no masking overhead
• Genomic adoption: Used by NVIDIA FLARE and BeeKeeperAI for healthcare FL
• Side-channel risk: Enclaves remain vulnerable to microarchitectural attacks

To reduce communication overhead in genomic models with millions of parameters, clients transmit only the top-k gradient elements by magnitude. The server aggregates sparse vectors and reconstructs a dense update.

• Compression ratio: Typically 100x–1000x reduction in payload
• Error feedback: Residual gradients are accumulated locally to prevent divergence
• Genomic relevance: Critical for federated training of DNABERT or Enformer across slow hospital networks
• Privacy amplification: Sparse updates provide an implicit privacy benefit by hiding most gradient values

Standard averaging is vulnerable to data poisoning where a malicious hospital submits corrupted updates. Robust aggregation replaces the mean with statistical operators resistant to outliers.

• Krum: Selects the update closest to its n − b − 2 nearest neighbors
• Trimmed Mean: Discards extreme values per coordinate before averaging
• Median: Uses coordinate-wise median instead of mean
• Genomic threat model: A compromised sequencer could inject backdoors into variant calling models

The core cryptographic primitive underlying most practical secure aggregation protocols. Secret sharing splits a client's model update into multiple mathematical shares that are individually meaningless and distributed to other parties. The original secret can only be reconstructed when a threshold of shares is combined. In secure aggregation, this ensures that the central server cannot reconstruct any individual update unless it colludes with a threshold number of clients, a property known as t-out-of-n security.

A specific technique used in efficient secure aggregation protocols where each pair of clients agrees on a random mask. One client adds the mask to its update, and the other subtracts it. When the server sums all masked updates, the pairwise masks cancel out, revealing only the true sum. This method is computationally lightweight compared to full homomorphic encryption and is the basis for Google's seminal secure aggregation protocol for cross-device federated learning.

The resilience property required when a subset of clients in a secure aggregation round may behave arbitrarily—either due to hardware failure or malicious intent. A Byzantine client might send a corrupted share to disrupt the reconstruction or drop out mid-protocol. Robust secure aggregation protocols must tolerate such failures without halting the entire round. Techniques include using shamir secret sharing with a threshold lower than the total number of clients, allowing the sum to be reconstructed even if a minority of clients fail.

A hardware-based alternative to cryptographic secure aggregation. A TEE, such as Intel SGX or AMD SEV, creates an isolated enclave within the server's CPU where code and data are protected from the host operating system. Clients can send their raw updates to the enclave, which performs the aggregation in plaintext before discarding individual data. This offers a different trust model—shifting trust from mathematics to hardware manufacturers—and is often used in cross-silo genomic consortia for its computational efficiency.