Secure Aggregation

The central server learns nothing beyond the aggregated sum of all client updates. An honest-but-curious server cannot isolate or reconstruct any individual client's gradient vector. This is typically achieved through pairwise additive masking where clients agree on random seeds. Each client adds a mask to their update; when all masks are summed, they cancel out to zero, revealing only the aggregate. This property is the primary defense against gradient leakage attacks in cross-silo healthcare deployments.

The protocol must successfully complete aggregation even if a subset of clients disconnects or fails mid-computation. This is handled via Shamir's Secret Sharing (t-out-of-n threshold scheme). Each client splits its random seed into shares and distributes them to other clients. As long as a minimum threshold t of clients survive, the remaining participants can reconstruct the masks of the dropped users and remove them from the aggregate. This is critical for cross-device FL with unreliable mobile or edge devices.

The protocol must prevent a malicious client from poisoning the aggregate with a crafted update that corrupts the global model. While basic secure aggregation only guarantees input privacy, extensions add Byzantine-robust aggregation rules (e.g., Krum, trimmed mean) executed inside a secure computation enclave. Alternatively, zero-knowledge proofs (ZKPs) can be attached to each update to prove it was computed correctly on a valid local dataset without revealing the data itself.

Naive secure aggregation requires O(n²) communication between n clients for key exchange and secret sharing. Production protocols like the SecAgg+ algorithm reduce this to O(n log n) by organizing clients into a sparse, logarithmic-degree graph for pairwise masking. Further optimizations use sub-sampling: only a randomly selected subset of clients participates in each round, reducing the total cryptographic overhead while maintaining statistical convergence of the global model.

The protocol must allow the server to verify that the final aggregate is computed correctly without accessing individual inputs. This is achieved through commitment schemes: each client publishes a cryptographic commitment to its masked input before revealing it. After aggregation, the server can check that the sum of commitments matches the commitment to the sum. This prevents a malicious server from tampering with the result or a client from equivocating about its submitted update.

In long-running healthcare FL systems, the set of participating hospitals changes over time. The protocol must support efficient client join/leave operations without re-executing the full setup phase. Modern protocols use continuous group key agreement (CGKA) techniques, where a central coordinator maintains a ratcheted group state. When a new hospital joins, it receives the current epoch key via a secure channel; when one leaves, the group key is updated to exclude it, ensuring forward secrecy for departed members.