Secure Aggregation (SecAgg)

The foundational privacy mechanism where each pair of clients agrees on a shared secret mask using Diffie-Hellman Key Exchange. Client u adds a mask for every other client v to its update vector. When the server sums all masked updates, these pairwise masks mathematically cancel out, revealing only the aggregate sum. The server sees only a one-time pad obfuscation of each individual gradient, preventing gradient leakage and reconstruction of private training data.

Real-world federated learning rounds experience client dropouts due to connectivity or battery constraints. SecAgg achieves dropout resilience by having each client distribute Shamir Secret Shares of its pairwise mask seeds to all other clients. If a client drops out before unmasking, a threshold number of surviving clients can reconstruct the missing mask, allowing the server to remove it from the aggregate. This ensures the protocol completes correctly even when a significant fraction of participants disconnect.

The protocol operates under a semi-honest security model (honest-but-curious) in its base form, assuming the server follows the protocol correctly but may attempt to learn individual updates. Enhancements using Zero-Knowledge Proofs and Commitment Schemes can upgrade this to malicious security, where the server is cryptographically prevented from deviating from the specification—such as by dropping specific clients to isolate their updates or injecting false aggregates—without immediate detection.

Naive pairwise masking would require quadratic O(n²) communication per round. SecAgg uses a Pseudorandom Generator (PRG) to expand a short shared seed into a long mask vector. Clients only exchange the compact seeds during the key agreement phase, then locally expand them into full-length masks. This reduces bandwidth overhead from gigabytes to kilobytes per client, making the protocol practical for large cohorts training deep neural networks with millions of parameters.

While SecAgg provides input privacy, it does not inherently guarantee correctness against adversarial clients submitting poisoned updates. Production systems layer Byzantine Fault Tolerance mechanisms on top of the aggregation. Techniques like gradient clipping (bounding the L2 norm of updates) and robust aggregation rules (e.g., coordinate-wise median or Krum) are applied to the final sum to neutralize the influence of malicious clients attempting to corrupt the global model.

Modern SecAgg implementations are evolving to incorporate Learning With Errors (LWE)-based cryptography for Forward Secrecy. This ensures that if a client's long-term identity key is compromised in the future, past protocol rounds remain secure because the ephemeral session keys used for masking are not recoverable. Lattice-based constructions also provide resistance against future quantum adversaries, future-proofing the privacy guarantees of long-lived federated learning systems.

A core mechanism in SecAgg where each pair of clients agrees on a shared secret mask. Client u adds a mask for every other client v, and v subtracts the corresponding mask. When the server sums all updates, these pairwise masks cancel out, hiding individual contributions while revealing only the aggregate. This requires a key agreement protocol like Diffie-Hellman to establish the shared secrets.

A cryptographic method that splits a secret into multiple shares distributed among participants. In SecAgg, clients use Shamir Secret Sharing to distribute their private keys to other clients. If a client drops out, a threshold of remaining clients can reconstruct the missing mask, providing dropout resilience. Only a qualified subset can recover the secret, ensuring no single party holds the key.

The property that allows a secure aggregation round to complete successfully even when a subset of clients disconnects or fails. Without this, a single straggler would block the entire computation. SecAgg achieves this by having clients secret-share their keys; if a client drops, a threshold of survivors reconstructs the missing mask. This is critical for federated learning at scale, where mobile devices frequently go offline.

A security assumption where adversaries follow the protocol correctly but may attempt to learn additional information from the transcript. Also called honest-but-curious. The original SecAgg protocol assumes this model—the server computes the sum honestly but might inspect messages. For stronger guarantees against servers that inject false data or deviate arbitrarily, protocols must be upgraded to malicious security with zero-knowledge proofs.

The primary threat that SecAgg prevents. An adversary with access to individual model updates can apply gradient inversion attacks to reconstruct private training data, including images and text. By ensuring the server only sees the aggregate sum, SecAgg eliminates this attack surface. Without SecAgg, even a honest server becomes a single point of privacy failure if compromised.

A foundational key agreement protocol enabling two parties to establish a shared secret over a public channel. In SecAgg, each client pair performs a Diffie-Hellman exchange to derive the pairwise mask seed. Security relies on the computational hardness of the discrete logarithm problem. Combined with a pseudorandom generator (PRG) , the short seed is expanded into a full mask, minimizing communication overhead.