Pairwise Masking

The foundational key agreement protocol enabling two clients to establish a shared secret over a public channel. In pairwise masking, each pair of clients performs a Diffie-Hellman exchange to derive a common seed. This seed is then expanded using a Pseudorandom Generator (PRG) to generate the mask added to one client's update and subtracted from the other's. Security relies on the computational hardness of the discrete logarithm problem, ensuring an eavesdropping server cannot derive the shared mask.

A cryptographic method for distributing a secret among a group so that only a qualified subset can reconstruct it. In secure aggregation, if a client drops out, its pairwise mask would corrupt the sum. To provide dropout resilience, each client splits its secret key using Shamir Secret Sharing and distributes shares to all other clients. If a client disconnects, a threshold of remaining clients can reconstruct the missing mask, allowing the server to cancel it out and recover the correct aggregate.

A deterministic algorithm that expands a short, uniformly random seed into a long sequence of computationally random bits. In pairwise masking, the shared Diffie-Hellman key is used as a seed for a PRG to efficiently generate large masks matching the size of model updates. This avoids transmitting the full mask over the network. The security guarantee is that the PRG output is computationally indistinguishable from true randomness, preventing the server from distinguishing the masked update from noise.

The standard adversarial model assumed by basic pairwise masking protocols, also known as honest-but-curious. Under this model, all participants—including the central server—follow the protocol specification correctly but may attempt to learn additional information from the protocol transcript. The server aggregates updates honestly but tries to infer individual contributions. Pairwise masking provides strong guarantees in this model, as the server only sees the final sum. Upgrading to malicious security requires additional primitives like zero-knowledge proofs.

The primary threat that pairwise masking is designed to neutralize. Gradient leakage attacks allow an adversary with access to individual model updates to reconstruct private training data—including images, text, and medical records. By ensuring the server only sees the aggregate sum where pairwise masks cancel out, individual gradients are never exposed in plaintext. This provides a strong cryptographic barrier against inversion attacks, membership inference, and other reconstruction techniques that exploit gradient information.

A symmetric encryption scheme providing confidentiality, integrity, and authenticity simultaneously. In pairwise masking protocols, once masks are applied, the masked update is encrypted with the server's public key using authenticated encryption before transmission. This prevents a network adversary from tampering with the masked update or injecting false data. The authentication tag ensures the server can verify that the received ciphertext was not modified in transit, protecting against chosen-ciphertext attacks.