Secure Aggregation

Clients protect their local model updates by adding pairwise secret masks to their vectors before transmission. These masks are generated using Diffie-Hellman key agreement between client pairs. When all masked updates are summed on the server, the masks mathematically cancel out, revealing only the aggregate sum. A dropped client is handled by reconstructing its secrets through Shamir's Secret Sharing, ensuring the protocol is robust to device churn without compromising the privacy of remaining participants.

A critical property for real-world mobile and edge deployments where clients frequently disconnect. The protocol uses t-out-of-n secret sharing to distribute each client's private seed to a quorum of peers. If a client drops out before unmasking, a sufficient number of surviving clients can reconstruct the missing mask, allowing the server to remove it from the aggregate. This ensures a single straggler does not block the entire training round.

Secure aggregation can be combined with Byzantine-resilient aggregation rules like Krum or coordinate-wise median to defend against malicious clients attempting model poisoning. While standard secure aggregation only provides input privacy, integrating it with robust statistics ensures the final aggregate is not skewed by adversarial updates. This dual-layer defense protects both the confidentiality of local data and the integrity of the global model.

Modern protocols optimize the heavy cryptographic overhead of pairwise masking. Techniques like secret sharing with a single trusted third party or leveraging Trusted Execution Environments (TEEs) can reduce client communication from O(n) to O(1). Additionally, the use of pseudorandom generators (PRGs) allows clients to expand short seeds into full mask vectors, dramatically reducing the bandwidth required for mask distribution compared to transmitting full entropy masks.

The protocol provides forward secrecy for individual training rounds. The pairwise masks are ephemeral and generated fresh for each aggregation round using ephemeral Diffie-Hellman keys. If a client's long-term identity key is compromised in the future, past model updates remain protected because the masking secrets for those historical rounds were deleted after use and cannot be retroactively decrypted.

Secure aggregation prevents the server from seeing individual updates, but the aggregate itself may still leak information through membership inference. To provide a formal privacy guarantee, the protocol is often combined with Differentially Private Stochastic Gradient Descent (DP-SGD). Clients apply norm clipping and add calibrated Gaussian noise to their updates locally before masking, ensuring the final aggregate satisfies a bounded privacy budget (ε, δ).

A foundational cryptographic method that splits a secret into multiple shares distributed among participants. The original secret can only be reconstructed when a threshold number of shares are combined. In secure aggregation, Shamir's Secret Sharing is often used so the server learns only the sum of updates, not individual contributions, even if some clients drop out. A t-of-n scheme requires t shares for reconstruction, tolerating up to n-t failures.

The resilience of a distributed system to arbitrary node failures or malicious actors sending conflicting information. In secure aggregation, Byzantine-resilient aggregation rules like Krum or Trimmed Mean filter out poisoned updates before summing. This defends against model poisoning attacks where an adversary controls multiple clients and submits crafted gradients to corrupt the global model or embed backdoors.

A hardware-enforced isolated enclave within a processor that protects code and data from the host OS and cloud provider. TEEs like Intel SGX or AMD SEV offer an alternative to pure cryptographic secure aggregation: clients send encrypted updates to an enclave that decrypts and aggregates them in a shielded memory region. Remote attestation verifies the enclave's integrity before clients trust it with sensitive data.