Secure Aggregation (SecAgg)

The central server learns only the aggregated sum of client updates and gains no information about any individual client's local gradient. This is achieved through pairwise additive masking, where each pair of clients agrees on a shared secret. One client adds the mask to its update, the other subtracts it. When all updates are summed, the masks cancel out, revealing only the true aggregate. This provides a computational privacy guarantee against an honest-but-curious server, ensuring that even a fully compromised aggregator cannot isolate a single hospital's contribution to a diagnostic model.

In real-world federated networks, clients frequently disconnect due to unreliable hospital networks or device power constraints. SecAgg protocols include a secret sharing recovery mechanism to handle such dropouts without stalling the round. Each client generates a t-out-of-n Shamir secret share of its private key and distributes the shares to other clients. If a client drops out before revealing its mask, a sufficient threshold of remaining clients can reconstruct the missing mask, allowing the server to remove it from the aggregate and successfully complete the computation. This ensures the protocol is resilient to client churn.

Advanced SecAgg implementations integrate defenses against Byzantine adversaries—clients that may behave arbitrarily or maliciously to corrupt the global model. Techniques like Krum or Trimmed Mean are applied post-aggregation to filter out anomalous updates. Additionally, zero-knowledge proofs can be layered into the protocol, requiring each client to prove that its masked update was correctly generated without revealing the underlying data. This prevents a malicious client from submitting a poisoned update that would degrade a collaborative cancer detection model.

A naive SecAgg protocol requires O(n²) communication for pairwise masking among n clients, which is prohibitive for large cross-device networks. Modern protocols reduce this overhead through sparse random graphs and sub-sampling. Instead of every client pairing with every other, each client exchanges keys with only a logarithmic subset of peers. Combined with gradient compression techniques like quantization, the total bandwidth per round is dramatically reduced, making secure aggregation feasible for federated learning across hundreds of hospitals without saturating network links.

Standard SecAgg relies on Diffie-Hellman key exchange, which is vulnerable to future quantum adversaries capable of running Shor's algorithm. Next-generation protocols are being designed with lattice-based cryptography to achieve post-quantum security. These schemes replace the discrete logarithm problem with the Learning With Errors (LWE) problem, which is believed to be hard even for quantum computers. This ensures that encrypted model updates from medical devices remain private against long-term archival attacks, where an adversary might store ciphertext today to decrypt it with a future quantum computer.

SecAgg protects the computation, but the aggregate itself can still leak information. To provide a formal end-to-end privacy guarantee, SecAgg is combined with Differential Privacy (DP). Before a client sends its masked update, it clips the gradient norm and adds calibrated Gaussian noise. The server then securely sums these noisy updates. This ensures that the final global model satisfies (ε, δ)-differential privacy, meaning the probability of any output changes by at most a factor of e^ε whether or not a single patient's record was included in any hospital's training set.

A foundational cryptographic primitive that splits a secret (such as a model update) into multiple shares distributed among participants. The original secret can only be reconstructed when a threshold number of shares are combined. In SecAgg, Shamir's Secret Sharing ensures that no single party—including the aggregation server—can inspect an individual client's gradient. A client's update remains information-theoretically hidden even if up to t parties are compromised.

A technique where each client generates a random mask for every other client in the protocol round. These masks are designed to cancel out when all updates are summed: mask_{i,j} + mask_{j,i} = 0. This allows the server to compute the correct aggregate without ever seeing an individual's unmasked contribution. The protocol relies on Diffie-Hellman key agreement to establish shared secrets between each pair of clients.

A critical property of practical SecAgg protocols that allows the aggregation to complete successfully even when a subset of clients disconnect or fail mid-round. This is achieved by having surviving clients reconstruct the secret shares of dropped users. The protocol must tolerate up to a configurable dropout rate without leaking individual updates or requiring the round to restart.

A mathematical framework that provides a quantifiable privacy guarantee against membership inference. While SecAgg protects updates in transit, DP protects against what the aggregate itself might reveal. The two are often combined: SecAgg ensures the server sees only the sum, and central DP noise is added to that sum before model update, bounding the privacy loss per training round to a strict epsilon budget.

A broader cryptographic paradigm enabling multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. SecAgg is a specialized, highly efficient instance of SMPC optimized for the specific function of summation. General SMPC protocols can compute arbitrary functions but incur significantly higher communication and computation overhead.

A cryptographic scheme that allows computation directly on ciphertexts, producing an encrypted result that decrypts to the correct plaintext output. Unlike SecAgg's masking approach, HE enables the server to perform arbitrary operations on encrypted updates, not just summation. However, fully homomorphic encryption remains computationally prohibitive for large-scale federated training compared to the lightweight primitives used in SecAgg.