Secure Multi-Party Computation (SMPC)

The fundamental guarantee that no party learns anything about another party's private inputs beyond what can be logically inferred from the final, agreed-upon output. This is achieved through secret sharing, where private data is split into mathematically random shares that are individually meaningless. Even if an adversary corrupts a subset of parties and observes all messages, the privacy of honest parties' inputs remains computationally or information-theoretically secure. This property is critical for privacy-preserving inference where a client's query and a model owner's proprietary weights must both remain confidential.

The protocol must guarantee that the computed output is exactly the result of applying the agreed-upon function to the private inputs, as if a trusted third party had performed the calculation in the clear. This property holds even in the presence of malicious adversaries who actively deviate from the protocol specification. Correctness is enforced through zero-knowledge proofs and message authentication codes (MACs) that allow honest parties to detect and abort upon cheating behavior, ensuring the integrity of the collaborative computation.

A property ensuring that either all parties receive the final output, or none do. Without fairness, a malicious party could learn the result and then abort the protocol before other participants receive it, gaining an unfair advantage. In the standard dishonest majority setting, fairness is generally impossible to achieve for arbitrary functions. However, in honest majority settings or through techniques like gradual release, partial fairness can be guaranteed, preventing premature termination from harming honest participants.

A stronger property than fairness, Guaranteed Output Delivery (GOD) ensures that honest parties will always receive the correct output regardless of malicious behavior by other participants. The protocol cannot be halted by an adversary. This is typically achievable only when the adversary controls less than one-third of the parties in a synchronous network. Achieving GOD requires robust consensus mechanisms and redundant computation paths, making it a gold standard for high-integrity decentralized systems.

SMPC protocols are proven secure under specific adversarial models:

• Semi-Honest (Honest-but-Curious): Adversaries follow the protocol correctly but attempt to learn additional information from the message transcript. This is the most efficient setting.
• Malicious: Adversaries may arbitrarily deviate from the protocol to break privacy or correctness. Defenses require expensive cryptographic machinery like cut-and-choose or SPDZ-style MACs.
• Covert: Adversaries are willing to cheat but only if they are not caught. This model provides a practical middle ground with a deterrence-based security guarantee.

The foundational building block for input privacy. A secret value is split into multiple shares distributed among parties such that no single share reveals information about the secret.

• Additive Secret Sharing: A value x is split into random shares x1, x2, ..., xn such that x = x1 + x2 + ... + xn. This allows for linear operations to be performed locally on shares.
• Shamir's Secret Sharing: Based on polynomial interpolation, a secret is embedded as the constant term of a polynomial of degree t. Any t+1 shares can reconstruct the secret, while t or fewer reveal nothing. This enables threshold cryptography.

A cryptographic scheme that enables computation directly on encrypted data, producing an encrypted result that, when decrypted, matches the result of the operations as if they were performed on the plaintext. Unlike SMPC, which distributes computation across parties, HE allows a single untrusted server to process data without ever decrypting it.

• Fully Homomorphic Encryption (FHE) supports arbitrary computation but incurs significant computational overhead.
• Partially Homomorphic Encryption (PHE) supports only a single operation type (e.g., addition) and is more practical for specific use cases.
• Often combined with SMPC in hybrid protocols to balance communication and computation costs.

A hardware-enforced secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. TEEs isolate sensitive model processing from the host operating system, hypervisor, and other privileged software.

• Intel SGX and AMD SEV are the dominant implementations in cloud environments.
• Provides a different trust model than SMPC: relies on hardware manufacturer attestation rather than cryptographic distribution of trust.
• Used in Confidential AI Computing to protect model weights and inference data from cloud operators.

A mathematical framework that provides a provable guarantee against privacy leakage by injecting calibrated statistical noise into computations. The output of a DP analysis is nearly indistinguishable whether or not any single individual's data is included.

• Epsilon (ε) quantifies the privacy loss budget; lower values provide stronger guarantees.
• DP-SGD is the standard training algorithm that clips per-sample gradients and adds Gaussian noise during each step.
• Complements SMPC: SMPC protects data during computation, while DP protects the output from revealing individual contributions.

A cryptographic protocol in federated learning that allows a central server to compute the sum of model updates from multiple clients without inspecting any individual client's contribution. This is a specific, highly optimized application of SMPC principles.

• Relies on secret sharing and pairwise masking between clients.
• Ensures that even if the server is compromised, individual training data cannot be reconstructed from gradient updates.
• Critical for preventing gradient leakage attacks that can reconstruct private training samples from model updates.

A decentralized machine learning paradigm where a shared global model is trained across multiple client devices holding local data samples, without the raw data ever leaving the device. FL and SMPC are often deployed together to provide defense-in-depth privacy.

• Cross-silo FL involves a small number of institutional clients (e.g., hospitals) and benefits most from SMPC integration.
• Cross-device FL involves millions of edge devices and typically relies on secure aggregation rather than full SMPC.
• The combination of FL + SMPC enables collaborative model training on sensitive data across organizational boundaries.

A class of aggregation rules in distributed learning designed to tolerate the presence of malicious or faulty nodes that send arbitrary or adversarial updates to derail the training process. This is essential when SMPC protects privacy but cannot guarantee participant honesty.

• Krum and Trimmed Mean are common algorithms that filter out outlier gradient updates.
• Addresses the threat model where an adversary controls a fraction of SMPC computation parties.
• Ensures that privacy guarantees do not come at the cost of model integrity in adversarial settings.