Semi-Honest Security

In the semi-honest model, all parties—including the adversary—execute the protocol exactly as specified. There is no deviation, no injection of malformed messages, and no premature abort. This assumption dramatically simplifies protocol design because correctness is never in question. The adversary will not send invalid shares, corrupt intermediate values, or refuse to participate. This compliance guarantee allows cryptographers to focus exclusively on information leakage rather than robustness to arbitrary faults.

The adversary is passive—it observes the protocol transcript, including all messages received and any intermediate computations performed locally, but never interferes with execution. This is fundamentally different from active adversaries that can modify, replay, or suppress messages. The passive adversary's goal is purely eavesdropping: extracting private inputs from the legitimate messages it sees. In secure aggregation, this means a curious server correctly sums encrypted updates while attempting to infer individual client contributions from the aggregate.

The adversary's attack surface is limited to the protocol transcript—the complete record of all messages exchanged during execution. Security requires that this transcript reveals nothing beyond the intended output. Formally, for any semi-honest adversary, there must exist a simulator that can produce a computationally indistinguishable transcript given only the adversary's input and the protocol's output. This simulation paradigm proves that participation leaks no additional information. If something can be simulated without access to honest parties' private inputs, observing it in the real protocol reveals nothing.

Semi-honest protocols typically specify collusion thresholds—the maximum number of parties the adversary may corrupt and still guarantee security. A protocol secure against t semi-honest corruptions means any coalition of up to t parties pooling their views cannot learn the inputs of the remaining honest parties. In secure aggregation with pairwise masking, security often holds against all-but-one collusion: the server and any subset of clients cannot unmask a single honest client's update. These thresholds define the protocol's privacy ceiling.

Protocols designed for semi-honest security are significantly more efficient than their maliciously secure counterparts. They avoid expensive zero-knowledge proofs, consistency checks, and Byzantine agreement mechanisms. In practice, semi-honest secure aggregation can use simple one-time pads and secret sharing without verifiability overhead. This efficiency gap—often 10-100x in communication and computation—makes semi-honest protocols the pragmatic choice when participants are trusted to follow the protocol but not trusted to see raw data, such as in federated learning across hospitals or banks.

Semi-honest security sits between unconditional trust and malicious security on the threat model spectrum. It is stronger than assuming all parties are fully trusted, yet weaker than defending against arbitrary Byzantine behavior. Many real-world deployments use semi-honest protocols augmented with lightweight integrity checks—such as authenticated encryption or aggregate signatures—to detect accidental deviations without the full cost of malicious security. This hybrid approach acknowledges that while participants are not actively malicious, implementation bugs or misconfigurations can cause protocol violations that should be caught.

The canonical synonym for semi-honest security, formalized in foundational multi-party computation literature. The adversary follows the protocol exactly but logs all intermediate messages.

• Also called passive security in the cryptographic literature
• Assumes the adversary does not modify its local random tape or deviate from the prescribed message schedule
• The baseline security model for most efficient secure aggregation protocols like SecAgg

The primary privacy threat that semi-honest security models aim to prevent. An adversary analyzing shared model gradients can reconstruct private training data through optimization-based attacks.

• Deep Leakage from Gradients (DLG) iteratively finds synthetic inputs whose gradients match observed updates
• Even a semi-honest server could mount these attacks if given access to individual client updates
• Secure aggregation eliminates this vector by ensuring the server only sees the aggregate sum, never individual contributions

An intermediate security model between semi-honest and malicious security. Adversaries may cheat arbitrarily, but are detected with a specified probability if they do so.

• Provides a practical trade-off: stronger guarantees than semi-honest with lower overhead than full malicious security
• Cheating is deterred by a non-negligible chance of detection and associated reputational or financial penalties
• Useful when participants are mutually distrustful but have long-term incentives to maintain honest behavior

A rigorous cryptographic framework for analyzing protocol security under arbitrary composition. A protocol proven secure in the UC framework remains secure even when run concurrently with other protocols.

• Semi-honest protocols often serve as building blocks that are later compiled into maliciously secure variants using GMW compiler techniques
• UC security requires an explicit environment machine that models all external interactions
• Provides the strongest theoretical guarantee that protocol security holds in real-world deployment scenarios