Secure Aggregation

The fundamental guarantee that the central server learns nothing about any individual client's model update beyond what is inferable from the final aggregated sum. This is achieved through pairwise masking or secret sharing techniques, where each client adds random noise that cancels out only when all contributions are summed. Even if the server is honest-but-curious (following the protocol while attempting to learn individual inputs), it cannot isolate a single client's gradient vector.

The protocol must tolerate clients dropping out mid-round due to network failures or device unavailability without stalling the entire aggregation. This is typically handled through t-out-of-n threshold secret sharing, where each client's random mask is split into shares distributed among other clients. If a client drops out, a sufficient threshold of remaining clients can reconstruct the missing mask, allowing the server to remove it from the sum and complete the aggregation. The Bonawitz et al. (2017) protocol from Google pioneered this approach.

Secure aggregation must scale to hundreds or thousands of clients with high-dimensional model updates (millions of parameters). Naive approaches requiring all-to-all communication are infeasible. Modern protocols reduce communication complexity through:

• Sub-sampling: Only a random subset of clients participates in each round
• Sparse secret sharing: Leveraging the sparsity of gradient updates
• Quantization: Compressing updates to lower bit-widths before encryption
• Recursive reconstruction: Hierarchical aggregation trees that minimize server-side computation

Beyond the honest-but-curious model, production deployments must defend against active adversaries who may deviate from the protocol to corrupt the aggregate. Defenses include:

• Commitment schemes: Clients commit to their inputs before revealing, preventing adaptive attacks
• Zero-knowledge range proofs: Verifying that updates fall within expected bounds without revealing the values
• Byzantine-robust aggregation: Replacing simple averaging with median-based or trimmed-mean operations that are resilient to poisoned inputs The SecAgg+ protocol extends the original design with these stronger adversarial guarantees.

Secure aggregation alone protects individual updates during transmission but does not prevent the final model from memorizing and leaking training data. Combining secure aggregation with distributed differential privacy closes this gap. Clients locally clip their updates and add calibrated Gaussian noise before encryption. The server receives only a noisy aggregate, providing a formal (ε, δ)-differential privacy guarantee. This dual-layer approach ensures that even the aggregated output reveals no single client's participation.

The cryptographic operations in secure aggregation introduce non-trivial overhead compared to plaintext federated averaging. Key cost factors include:

• Key agreement: Each pair of clients performs a Diffie-Hellman exchange to establish shared masks
• Secret sharing: Generating and distributing t-out-of-n shares for dropout tolerance
• Reconstruction: Servers must solve linear systems to recover missing masks Typical overhead ranges from 2-5x additional computation and 1.5-3x communication compared to unprotected aggregation, depending on the number of clients and dropout rate.

A key efficiency technique in protocols like Google's original SecAgg. Each client u generates a random mask for every other client v and shares it via a Diffie-Hellman key agreement. During the aggregation round, client u adds these masks to its update, and client v subtracts the corresponding mask. When the server sums all masked updates, the pairwise masks cancel out perfectly, leaving only the true sum. This avoids expensive public-key operations on the model weights themselves.

A critical practical requirement for federated learning systems where mobile devices or edge nodes frequently go offline. A secure aggregation protocol must guarantee that the sum of surviving users can still be reconstructed even if a fraction of clients drop out mid-round. This is typically achieved by having a subset of live clients assist in reconstructing the secret shares of the dropped users' masks, preventing those masks from corrupting the final aggregate sum.

The direct application of secure aggregation to the standard FedAvg algorithm. Instead of sending raw weight updates Δw_i to the parameter server, each client sends an encrypted or masked share. The server computes Σ Δw_i securely and updates the global model. This extension is now a standard deployment pattern in production systems like Google's Gboard and Apple's Private Federated Learning, enabling model improvement from sensitive on-device data like typing history without raw data exfiltration.