Secure Aggregation Protocol

Each client generates a random mask and a secret share of that mask distributed to other clients. During aggregation, the server sums the masked updates. Surviving clients reveal their shares to reconstruct the masks of dropped clients, allowing the server to unmask only the aggregate sum. This ensures individual updates remain hidden even if the server colludes with a subset of clients.

• Self-mask: A random value added to the local update
• Secret share: Threshold sharing of the mask among peers
• Dropout recovery: Masks of offline clients are reconstructed via t-of-n shares

Clients establish pairwise symmetric keys using Diffie-Hellman key agreement over an authenticated broadcast channel. Each client computes a pairwise mask with every other client, adding it to their update. When all pairwise masks are summed across the cohort, they cancel out to zero, leaving only the true aggregate. This eliminates the need for a trusted third party.

• Authenticated key exchange: Prevents man-in-the-middle attacks
• Cancellation property: Sum of all pairwise masks equals zero
• No server involvement: Keys are established client-to-client

Secure aggregation protocols incorporate robustness mechanisms to handle clients that deviate arbitrarily from the protocol. Techniques like Krum, trimmed mean, or multi-Krum filter out anomalous updates before aggregation. The protocol ensures that even if a fraction of clients are malicious, the global model update remains bounded and useful.

• Krum: Selects the update closest to a majority of others
• Trimmed mean: Discards extreme values per coordinate
• Bounded influence: Malicious updates cannot dominate the sum

Clients agree on a common random seed through a key exchange protocol. Each client generates a noise vector from this seed and adds it to their update. Since all clients use the same seed, the noise vectors are identical. When summed, the noise cancels out completely, revealing only the true aggregate. This provides information-theoretic privacy against the server.

• Synchronized randomness: Shared seed via group key agreement
• Cancellation: Identical noise vectors sum to zero
• No recovery needed: No dropout handling required for the noise component

Clients encrypt their updates using an additively homomorphic encryption scheme under a collective public key. The server can sum the ciphertexts directly without decryption. A threshold of clients must cooperate to decrypt the final aggregate, ensuring no single party can access individual updates. This approach is robust to client dropouts without additional recovery rounds.

• Additive homomorphism: Enc(a) + Enc(b) = Enc(a+b)
• Threshold decryption: Requires t-of-n clients to decrypt
• Dropout resilience: No mask reconstruction needed

The protocol includes cryptographic commitments that allow the server to verify that each client used the correct mask and input without seeing the raw values. Clients publish a commitment to their mask before the aggregation round. After receiving the masked update, the server can verify consistency, preventing clients from poisoning the aggregate with malformed inputs.

• Pedersen commitments: Hiding and binding commitments to masks
• Zero-knowledge proofs: Prove correctness without revealing secrets
• Input validation: Detect malformed updates before aggregation

A foundational cryptographic method that splits a secret into multiple shares, distributing them among parties. The secret can only be reconstructed when a sufficient threshold of shares is combined. In Secure Aggregation, Shamir's Secret Sharing is often used to mask individual model updates, ensuring that a client's contribution is unrecoverable unless a colluding majority of parties pool their shares, which the protocol cryptographically prevents.

A technique where each pair of clients agrees on a shared random seed to generate a masking vector. One client adds the mask to their update, and the other subtracts it. When the server sums all masked updates, the pairwise masks mathematically cancel out, revealing only the true global sum. This provides information-theoretic privacy for individual inputs without relying on computational hardness assumptions.

A protocol allowing two parties to establish a shared secret over an insecure channel. In Secure Aggregation, clients use Diffie-Hellman to securely generate the pairwise seeds for masking without requiring a pre-shared infrastructure. This ensures that an eavesdropping server cannot learn the masks and unmask individual updates.

A critical property of production Secure Aggregation protocols that handles clients disconnecting mid-computation. The protocol must ensure the global sum is still recoverable even if a subset of clients drops out. This is achieved by having surviving clients reconstruct the missing shares of dropped users' secrets, preventing a single client's network failure from stalling the entire federated round.

The resilience of the aggregation protocol against arbitrary or malicious behavior. Beyond simple dropouts, a Byzantine client might send corrupted data to poison the global model. Secure Aggregation protocols are often paired with robust aggregation rules that can detect and filter out anomalous updates, ensuring the computed sum is a faithful representation of the honest majority's contributions.

The practical cost of cryptographic operations in a Secure Aggregation round. The protocol's complexity is typically O(n²) for pairwise masking setup among n clients. For cross-silo federated learning with a small number of hospitals, this is negligible. However, for cross-device settings with thousands of smartphones, optimizing communication rounds and using techniques like secret sharing with a subset of neighbors is critical for scalability.