Secure Federated Averaging

The core cryptographic mechanism that replaces simple averaging. Clients encrypt their model updates using secret sharing or pairwise masking before transmission. The server computes the sum of the encrypted vectors, decrypting only the final aggregated result. This guarantees that the server, or any eavesdropper, learns nothing about an individual client's gradient beyond what is revealed by the global aggregate.

A critical practical requirement for federated learning systems with unreliable edge devices. The protocol is designed to tolerate a configurable fraction of clients dropping out mid-computation without stalling the entire round. This is typically achieved through t-threshold secret sharing, where the server can reconstruct the aggregate sum as long as a minimum number of clients successfully report their masked updates.

Secure aggregation protects updates during transit, but the global model itself can still leak information. This feature combines secure aggregation with distributed differential privacy. Clients clip their updates and add calibrated Gaussian noise before encryption. The server receives a privacy-guaranteed, noisy aggregate, providing a formal mathematical bound on information leakage even in the final model output.

Naive secure computation can inflate communication overhead. Optimized protocols leverage gradient compression and quantization before encryption. Techniques like random rotation and subsampling reduce the dimensionality of the vectors being secret-shared, dramatically lowering the byte-count transmitted per round while maintaining model accuracy and the cryptographic integrity of the secure aggregation.

Defends against adversarial clients attempting to poison the global model. The protocol incorporates robust aggregation rules, such as Krum or coordinate-wise median, computed over the secret-shared updates. This prevents a minority of malicious actors from arbitrarily manipulating the aggregated model, ensuring the system's integrity even without inspecting individual plaintext updates.

The protocol adapts to two distinct topologies. Cross-silo involves a small number of reliable institutional clients (e.g., hospitals) using computationally heavier MPC. Cross-device handles thousands of unreliable mobile devices, relying on lightweight pairwise masking and a central service provider orchestrating the protocol. The averaging logic remains consistent, but the cryptographic instantiation is tailored to the trust model and scale.

The foundational class of protocols that enables Secure Federated Averaging. A central server computes the sum of model updates from multiple clients without learning any individual client's contribution. This is typically achieved using pairwise masking where clients agree on random seeds with each other. Each client adds masks from all peers to its update. During aggregation, masks cancel out, revealing only the sum. The protocol is robust to client dropouts by incorporating secret sharing of masks for recovery. This ensures that even if the server inspects all incoming messages, it sees only random noise until the final aggregation step.

While secure aggregation hides individual updates during transmission, Differential Privacy (DP) provides formal protection against leakage through the final aggregated model itself. In Secure Federated Averaging, a Distributed Differential Privacy model is often applied: clients add calibrated noise to their updates before secure aggregation, or the server adds noise after aggregation. The combination ensures that the global model's parameters do not memorize or expose any single client's data. The privacy budget (ε, δ) quantifies the formal guarantee against membership inference attacks.

Pre-computed, secret-shared multiplication triples used in Secure Multi-Party Computation (MPC) protocols. A Beaver triple consists of three values (a, b, c) where c = a * b, with each value secretly shared among parties. These triples enable efficient, non-interactive multiplication of secretly shared values. In advanced Secure Federated Averaging implementations that go beyond simple summation—such as computing weighted averages or applying non-linear transformations—Beaver triples provide the cryptographic machinery for arithmetic operations on hidden data without expensive interactive protocols.

The core cryptographic mechanism in Google's original Practical Secure Aggregation protocol. Each client generates a Diffie-Hellman key pair and shares the public key with all other clients. For each pair of clients (u, v), they derive a shared secret using Elliptic Curve Diffie-Hellman (ECDH). This shared secret seeds a pseudorandom generator (PRG) to produce a mask. Client u adds masks for all v > u and subtracts masks for all v < u. When all masked updates are summed, the pairwise masks cancel exactly, revealing only the true sum of updates.