Secure Aggregation (SecAgg)

Each client's model update is masked using pairwise secret sharing and Diffie-Hellman key agreement. Clients generate random masks that cancel out when all updates are summed, ensuring the server only sees the aggregate. If a client drops out, the remaining clients reconstruct the missing masks using Shamir's t-out-of-n threshold scheme, preventing the protocol from stalling while maintaining the confidentiality of the dropped client's data.

SecAgg is designed for unreliable networks where clients may disconnect mid-round. The protocol maintains liveness through threshold secret sharing: each client distributes shares of its private key to a subset of peers. If a client drops out, a quorum of surviving clients can reconstruct the necessary decryption key, allowing the server to recover the aggregate without the missing client's individual contribution being revealed. This is critical for hospital networks with intermittent connectivity.

The protocol operates with O(n²) communication complexity but requires only a single, semi-honest aggregation server, avoiding the heavy overhead of general-purpose Secure Multi-Party Computation (SMPC). Clients perform one round of pairwise key exchange, then send a single masked vector per round. This makes SecAgg practical for federated training runs involving hundreds of hospitals contributing large diagnostic model weight matrices.

Without SecAgg, raw gradient updates transmitted to a server are susceptible to deep leakage from gradients and model inversion attacks, where an adversary can reconstruct high-fidelity training images from the gradients alone. SecAgg eliminates this attack surface by ensuring the server never observes an individual client's unmasked update, only the final summed result. This provides a mathematical guarantee against gradient-based data reconstruction.

SecAgg provides input privacy but does not bound what the final aggregate reveals about the training cohort. For formal privacy guarantees, SecAgg is combined with Differential Privacy (DP). Each client clips and noises its update locally before masking, or the server adds noise post-aggregation. This dual-layer approach—cryptographic masking plus statistical noise—provides defense-in-depth against both the server and downstream model consumers.

The standard SecAgg model assumes an honest-but-curious server that follows the protocol correctly but may attempt to inspect individual updates. Extensions using zero-knowledge proofs or publicly verifiable secret sharing can upgrade the trust model to defend against actively malicious servers that might deviate from the protocol to extract private information. This is essential for consortiums where no single institution operates the aggregation infrastructure.

A foundational cryptographic method where a secret value (a model update) is split into multiple shares distributed among participants. The original secret can only be reconstructed when a sufficient threshold of shares is combined. In SecAgg, this ensures the server cannot unmask a client's update even if it colludes with a subset of other clients. Shamir's Secret Sharing is the most common instantiation, using polynomial interpolation over a finite field.

A technique where each pair of clients agrees on a shared random seed to generate matching additive masks. Client u adds a mask for every other client v to its update, while client v subtracts the corresponding mask. When the server sums all masked updates, these pairwise masks cancel out, revealing only the true sum. This eliminates the need for a trusted third party to generate randomness.

A critical property of practical SecAgg protocols that allows the aggregation to complete successfully even when a subset of clients disconnects or fails mid-round. This is achieved by having surviving clients reconstruct the secret shares of dropped clients' seeds. Without this mechanism, a single client's network timeout would stall the entire federated training round indefinitely.

A cryptographic protocol enabling two parties to establish a shared secret over an insecure channel without prior knowledge of each other. In SecAgg, Diffie-Hellman is used to securely negotiate the pairwise masking seeds between clients. The security relies on the computational hardness of the discrete logarithm problem, ensuring an eavesdropping server cannot derive the masks.

The standard adversarial model assumed by SecAgg protocols. The server follows the aggregation protocol correctly but may attempt to infer private information by inspecting the data it receives. SecAgg provides formal cryptographic guarantees against this threat model. It does not, however, protect against a server that actively deviates from the protocol to poison the global model.

A specific threshold secret sharing scheme where a secret is encoded as the constant term of a random polynomial of degree t-1. Each share is a point on this polynomial. Reconstruction requires any t shares to solve for the polynomial coefficients via Lagrange interpolation. In SecAgg, this allows a client's seed to be recovered by a quorum of honest clients if the original client drops out.