Secure Aggregation (SecAgg)

A formal privacy framework that injects calibrated statistical noise into the aggregated model updates. Unlike SecAgg, which uses cryptography to hide inputs during computation, DP-FedAvg provides a mathematical ε-delta guarantee that the final model's parameters do not leak information about any single patient's record.

• Mechanism: Gaussian or Laplacian noise is added to the sum of updates.
• Privacy Budget: Controlled by the parameter ε; lower values provide stronger privacy.
• Trade-off: Introduces a utility-privacy trade-off where noise degrades model accuracy.

A cryptographic primitive that allows mathematical operations to be performed directly on ciphertexts, generating an encrypted result that decrypts to the correct plaintext output. In federated learning, HE enables the server to compute the encrypted sum of model updates without ever decrypting individual contributions.

• Additive HE: Supports only addition, sufficient for basic FedAvg.
• Fully HE (FHE): Supports arbitrary computation but incurs massive computational overhead.
• Relation to SecAgg: SecAgg is often more communication-efficient than HE for the specific task of secure summation.

A subfield of cryptography enabling multiple parties to jointly compute a function over their private inputs while revealing nothing beyond the output. SecAgg is a specialized, highly optimized instance of SMPC designed for the high-dimensional vector summation required in federated learning.

• Secret Sharing: Additive secret sharing schemes like Shamir's are foundational to SecAgg.
• Garbled Circuits: A general-purpose SMPC technique, often too expensive for model aggregation.
• Security Model: SecAgg typically operates in the semi-honest model, assuming parties follow the protocol but may be curious.

The core cryptographic mechanism within Google's original SecAgg design. Each client generates a secret random mask shared pairwise with another client via Diffie-Hellman key agreement. When all masks are summed, they cancel out, revealing only the aggregate model update.

• Self-Mask: A second mask protects against dropped clients; the server can reconstruct it only if a threshold of users survive.
• Shamir Secret Sharing: Used to distribute shares of the self-mask seed among other clients.
• Dropout Robustness: The protocol tolerates a configurable fraction of clients disconnecting mid-round.

A class of robust aggregation rules ensuring the global model converges correctly even when a subset of nodes submits arbitrary, malicious, or corrupted updates. While SecAgg protects privacy, BFT aggregation protects model integrity against adversarial clients attempting to poison the global model.

• Krum: Selects the update vector with minimal sum of squared distances to its nearest neighbors.
• Trimmed Mean: Discards extreme values coordinate-wise before averaging.
• Combined Defense: Production systems often layer BFT aggregation on top of SecAgg for both privacy and robustness.

A defensive technique that constrains the L2 norm of each local model update to a predefined maximum threshold before aggregation. Clipping bounds the influence of any single client, providing a lightweight complement to SecAgg's privacy guarantees by limiting the potential damage from adversarial or anomalous updates.

• Norm Bounding: Ensures ||Δw||₂ ≤ S for a chosen sensitivity S.
• Adaptive Clipping: Dynamically adjusts the threshold based on the distribution of update norms.
• Privacy Amplification: Clipping is a prerequisite for meaningful differential privacy guarantees in DP-FedAvg.