Federated Secure Aggregation

The fundamental guarantee that the aggregator server learns nothing about individual client updates beyond the aggregated sum. This is achieved through pairwise masking where clients agree on shared random seeds to generate noise that cancels out during summation. Even if the server is compromised, it cannot reconstruct any single hospital's gradient vector.

• Protects against honest-but-curious servers
• Masks individual contributions with one-time pads
• Mathematically equivalent to each client adding random noise that sums to zero

The protocol must tolerate clients dropping out mid-round due to network failures or resource constraints without stalling the entire aggregation. Secret sharing techniques allow remaining clients to reconstruct the missing masks of dropped participants.

• Uses t-out-of-n threshold secret sharing
• Survives up to a configurable number of dropouts
• Eliminates the straggler bottleneck in synchronous rounds

Advanced secure aggregation schemes incorporate defenses against malicious clients that may submit corrupted or adversarial updates to poison the global model. Techniques like Krum and trimmed mean aggregation filter out anomalous contributions before summation.

• Detects and excludes poisoned gradient updates
• Maintains convergence despite adversarial participants
• Critical for multi-institutional healthcare networks with varying trust levels

Secure aggregation protocols minimize bandwidth overhead through gradient compression and sparsification before encryption. Clients transmit only the most significant parameter updates, reducing communication costs by up to 100x compared to dense transmission.

• Applies top-k sparsification to gradient vectors
• Combines with quantization to reduce bit-width
• Essential for cross-device FL on bandwidth-constrained hospital networks

The protocol maintains forward secrecy—if a client's long-term key is compromised, past aggregation rounds remain protected. Each round uses fresh ephemeral keys generated via Diffie-Hellman key exchange, ensuring that historical gradients cannot be retroactively decrypted.

• Ephemeral keys discarded after each round
• Prevents retrospective decryption attacks
• Aligns with HIPAA and GDPR data protection requirements

Clients can cryptographically verify that the server correctly aggregated their updates without tampering. Zero-knowledge proofs allow the aggregator to prove correctness of the summation without revealing individual inputs.

• Uses commitment schemes to bind clients to their updates
• Enables public auditability of the aggregation process
• Builds institutional trust in multi-hospital collaborations

A cryptographic protocol that distributes computation across multiple parties while keeping individual inputs private. In the context of aggregation, secret sharing schemes like Shamir's Secret Sharing split model updates into random fragments. The central server can only reconstruct the sum of the updates if a threshold of parties collaborates, mathematically preventing the inspection of any single hospital's gradient vector. This is distinct from pure homomorphic encryption as it relies on interactive communication between non-colluding servers.

A lightweight alternative to heavy cryptography, commonly used in cross-device FL. Clients negotiate pairwise random seeds with each other. Before sending an update, a client adds a mask derived from these seeds. During aggregation, the masks mathematically cancel out, revealing only the aggregate sum. Double masking adds a secondary layer of self-seed masks to ensure security even if some clients drop out mid-round, preventing the server from unmasking individual contributions by exploiting dropout signatures.

While Secure Aggregation hides individual updates from the server, it does not prevent the final global model from memorizing individual patient data. Differential Privacy is the standard defense against this. A DP-FedAvg protocol combines secure aggregation with client-side clipping and calibrated Gaussian noise addition. This ensures that the aggregated model's parameters are statistically indistinguishable whether or not a single patient's record was included in the training set, providing a formal mathematical privacy guarantee against membership inference attacks.

Secure Aggregation assumes semi-honest servers but not necessarily honest clients. Byzantine clients may send arbitrary, malicious updates to poison the global model. Robust aggregation rules like Krum or Coordinate-wise Median replace the simple weighted average. These algorithms select or compute a central tendency that is resilient to a minority of adversarial updates, ensuring a single malicious hospital cannot skew the diagnostic model by submitting extreme gradient values during the secure aggregation round.

A form of encryption that allows computation directly on ciphertexts. In a HE-secured aggregation scheme, clients encrypt their model updates with the server's public key. The server performs additive aggregation on the encrypted data without ever decrypting the individual vectors. Only the final encrypted sum is decrypted using the private key. This provides a non-interactive alternative to SMPC, eliminating the need for client-to-client communication, but often incurs significant computational overhead and ciphertext expansion.

The primary threat Secure Aggregation mitigates. In standard FL, raw gradients shared with the server can be inverted to reconstruct training data. Deep Leakage from Gradients (DLG) algorithms iteratively optimize dummy inputs to match the observed gradients, effectively stealing patient imaging data. Secure Aggregation mathematically breaks this attack vector by ensuring the server only sees the aggregate sum of gradients, which is a single high-dimensional vector that cannot be decomposed back into its constituent private contributions.