Dropout Resilience

The primary cryptographic mechanism enabling dropout resilience. Each client's update is split into n shares using a t-out-of-n threshold scheme (typically Shamir Secret Sharing), where only t shares are required for reconstruction. Clients distribute shares to peers before the aggregation round. If up to n - t clients drop out, the server can still reconstruct the sum from the surviving shares. This transforms client dropout from a protocol-breaking failure into an expected operational condition.

A specific polynomial-based threshold scheme foundational to dropout resilience. A secret s is encoded as the constant term of a degree t-1 polynomial over a finite field. Each client receives a distinct point on the polynomial as their share. Reconstruction uses Lagrange interpolation with any t shares to recover the secret. In secure aggregation, this allows the server to reconstruct the sum of updates from any subset of t surviving clients, while fewer than t shares reveal zero information about individual contributions.

A dual-mask architecture that combines efficiency with dropout resilience. Each client generates two masks for every other client:

• Self-mask: Derived from a PRG seed, added to the update
• Pairwise mask: Agreed via Diffie-Hellman key exchange, cancels out when all clients survive

If a client drops out, surviving clients reveal the self-mask seeds of the dropout, allowing the server to remove those masks and recover the aggregate. This avoids the computational overhead of full secret sharing for the common case while maintaining resilience.

An enhancement to standard secret sharing that protects against malicious clients who might distribute inconsistent or invalid shares during dropout recovery. VSS adds commitment schemes to each share distribution, allowing recipients to verify share correctness before accepting them. If a malicious dealer distributes invalid shares, honest clients can detect the inconsistency and exclude the dealer from the round. This ensures dropout resilience holds even under Byzantine fault models where adversaries actively sabotage recovery.

The minimum number of clients that must complete the protocol round for successful aggregation. This threshold is a design parameter balancing robustness against privacy:

• Higher threshold: More dropout tolerance, but fewer clients can be excluded before privacy degrades
• Lower threshold: Stronger privacy guarantees (more clients must collude to reconstruct), but less dropout resilience

Typical configurations set the threshold at 50-70% of total clients, ensuring aggregation succeeds even with substantial network churn while maintaining meaningful privacy against curious servers.

Dropout resilience mechanisms must integrate with straggler mitigation strategies to handle clients that are slow but not fully disconnected. Common approaches include:

• Timeout-based exclusion: Clients failing to respond within a deadline are treated as dropouts, triggering share recovery
• Coded computation: Redundant encoding of updates allows the server to proceed as soon as any t of n responses arrive, without waiting for stragglers
• Asynchronous aggregation: The server aggregates available updates immediately and incorporates late arrivals in subsequent rounds

This integration prevents a single slow device from stalling the entire federated learning round.

A technique where each pair of clients agrees on a shared secret mask via key agreement. Each client adds masks for all its peers to its model update. When the server sums all updates, pairwise masks cancel out because client A adds mask(A,B) while client B subtracts mask(A,B).

• Dropout handling: If a client drops, its pairwise masks no longer cancel
• Recovery mechanism: Surviving clients reconstruct the dropped client's masks using secret sharing
• Requires O(n²) communication but provides strong privacy with minimal server trust

A deterministic algorithm that expands a short random seed into a long pseudorandom sequence computationally indistinguishable from true randomness. In dropout-resilient aggregation, PRGs efficiently generate large masking vectors from small shared seeds, dramatically reducing communication overhead.

• Seed expansion: A 256-bit seed can generate megabytes of masking material
• Computational efficiency: PRG operations are orders of magnitude faster than transmitting full masks
• Enables clients to agree on masks by sharing only compact seeds rather than full vectors