Secure Aggregation

The core privacy mechanism relies on pairwise additive masks. Each client u generates a secret key sk_u and a public key pk_u. For every other client v, they compute a shared secret s_{u,v} using Diffie-Hellman key agreement. This secret seeds a pseudorandom number generator (PRNG) to produce a mask vector mask_{u,v}. Client u adds mask_{u,v} to its update if u < v, or subtracts it if u > v. When the server sums all masked updates, these pairwise masks cancel out exactly, revealing only the aggregate sum.

To handle client dropouts without stalling the protocol, each client splits its secret key sk_u into t shares using Shamir's Secret Sharing and distributes them to other clients. If a client drops out, a quorum of remaining clients can reconstruct the missing secret key, allowing the server to remove the dropout's self-mask and recover the aggregate. This ensures the protocol is t-resilient, surviving up to a configurable number of failures.

The server acts as an untrusted aggregator. It receives only masked vectors from each client. The server's sole capability is to perform a single, high-dimensional vector summation. It cannot unmask any individual vector because it lacks the pairwise secrets. The final output is the plaintext aggregate model update, which is mathematically equivalent to summing all original, unmasked updates. This property is known as input privacy against an honest-but-curious server.

The protocol introduces significant computational and communication overhead:

• Client Computation: O(n² + mn) operations for n clients and m model parameters, dominated by key agreement and masking.
• Bandwidth: Each client sends and receives O(n + m) data, which can be prohibitive for large models or cross-device settings with unreliable networks.
• Synchronization: All clients must participate in a synchronous round, making it vulnerable to stragglers. Practical deployments often use sub-sampling or trusted execution environments to mitigate these costs.

Without secure aggregation, shared gradients are vulnerable to gradient leakage or deep leakage attacks, where an adversary reconstructs private training data from individual updates. Secure aggregation mathematically prevents this class of attack by ensuring the server never observes a single client's gradient. The server only sees the sum, which is a lossy compression of all contributions. This is a critical defense in healthcare federated learning, where model updates can encode identifiable patient features.

A cryptographic scheme that permits direct computation on encrypted data, producing an encrypted result that decrypts to the correct output. In secure aggregation, HE allows the central server to sum encrypted model updates without ever seeing individual client contributions. Partially homomorphic encryption (PHE) supports only addition, making it computationally efficient for the aggregation use case, while fully homomorphic encryption (FHE) supports arbitrary operations but incurs significant overhead.

A cryptographic protocol enabling multiple parties to jointly compute a function over their private inputs while keeping those inputs secret. For secure aggregation, SMPC uses secret sharing—each client splits its update into fragments distributed among other clients or servers. The sum is reconstructed only when a threshold of shares is combined. Key techniques include:

• Shamir's Secret Sharing: Polynomial-based splitting
• Additive secret sharing: XOR or modular arithmetic splits
• Garbled circuits: Boolean circuit evaluation

An attack that reconstructs private local training data from shared model gradients. Even without direct access to raw data, an adversary can optimize dummy inputs to produce gradients matching the observed updates. Deep leakage from gradients (DLG) and inverting gradients (IG) are prominent techniques. Secure aggregation mitigates this by ensuring the server only sees the aggregated sum, not individual gradients, breaking the one-to-one mapping between updates and training samples.

The resilience of a distributed system to arbitrary failures or malicious actors sending conflicting information. In secure aggregation, Byzantine clients may submit corrupted updates to poison the global model. Robust aggregation rules like Krum, trimmed mean, and median-based aggregators filter out these outliers. The system must tolerate up to f out of n Byzantine participants while maintaining convergence guarantees.

A mathematical framework providing provable guarantees against information leakage by adding calibrated noise to data or model updates. When combined with secure aggregation, DP adds Gaussian or Laplacian noise to the aggregated sum before revealing it, bounding what any observer can infer about individual contributions. The privacy budget (epsilon) quantifies the total allowable privacy loss, with lower epsilon values providing stronger guarantees at the cost of model utility.

A secure, isolated area within a main processor that guarantees confidentiality and integrity of code and data loaded inside it. In secure aggregation, the aggregation server can run inside a TEE (e.g., Intel SGX, AMD SEV), providing hardware-attested proof that it executed the summation correctly without inspecting individual updates. This creates a hardware root of trust that complements cryptographic protocols like SMPC and HE.