Secure Aggregation

The fundamental guarantee that the central aggregator learns nothing about any individual client's local update beyond the aggregated sum. This is typically achieved through secret sharing or pairwise masking, where each client's vector is masked with random noise that cancels out only when all contributions are summed. Even if the server is compromised, it cannot isolate a single user's gradient. This property is crucial for compliance with data minimization principles in regulations like GDPR.

In real-world federated learning, clients frequently disconnect due to network instability or battery constraints. A secure aggregation protocol must remain correct and private even when a subset of users drops out mid-protocol. This is handled by having surviving clients reconstruct the missing masks through threshold secret sharing, where any subset of size t out of n clients can recover the necessary cancellation values. Without this property, a single dropped smartphone would stall the entire training round.

Beyond passive corruption, secure aggregation must defend against active adversaries who send maliciously crafted updates to corrupt the global model. Byzantine-robust aggregation rules, such as Krum or Trimmed Mean, are integrated into the protocol to filter out anomalous vectors before summing. This ensures that an attacker controlling a minority of clients cannot arbitrarily manipulate the aggregated result, maintaining both the integrity and the privacy of the computation.

A practical secure aggregation protocol must not impose prohibitive bandwidth overhead. Modern protocols reduce communication from quadratic O(n^2) to sub-linear or constant per-client costs using techniques like sparse random rotation and sub-sampling. Clients compress their masked updates before transmission, and the server reconstructs only the aggregate. This efficiency is non-negotiable for cross-device FL involving millions of edge devices on metered connections.

Also known as forward secrecy in the context of aggregation. If a client's long-term key is compromised in the future, it should not retroactively expose the plaintext of their previous model updates. This is enforced by generating ephemeral key pairs for each training round and deleting the private keys immediately after the masking phase. The protocol ensures that historical ciphertexts remain indecipherable even if the device is physically seized later.

Clients must be able to cryptographically verify that the server performed the aggregation honestly without inspecting the raw data. This is achieved through zero-knowledge proofs (ZKPs) or commitment schemes where the server publishes a proof that the final model is a linear combination of the committed client updates. This prevents a malicious server from injecting a backdoor into the global model while claiming it was the result of legitimate client contributions.

A class of aggregation rules designed to tolerate malicious or faulty nodes in distributed learning. Standard averaging is vulnerable to a single adversarial update that can arbitrarily skew the global model. Byzantine-robust methods like Krum, Trimmed Mean, and Median statistically filter out outliers before aggregation, ensuring the training process converges even when some fraction of clients are compromised.

The primary threat that secure aggregation mitigates. Research has demonstrated that shared gradient updates can be inverted to reconstruct private training data, including pixel-level details of images and exact text sequences. Techniques like Deep Leakage from Gradients (DLG) and Inverting Gradients exploit the fact that gradients encode substantial information about their source data, making raw update sharing a critical privacy vulnerability.

An alternative cryptographic approach to secure aggregation that enables computation directly on encrypted data. Clients encrypt their updates before transmission, and the server performs the aggregation on the ciphertexts, producing an encrypted result that only the key holder can decrypt. While offering strong security guarantees, HE imposes significant computational overhead and communication costs compared to secret-sharing-based SMPC protocols.