Secure Aggregation

The fundamental guarantee that the aggregation server learns nothing about an individual client's model update beyond the final aggregated sum. This is achieved through pairwise masking with secret sharing, where clients add random masks to their updates that cancel out only when all updates are summed. Even if the server is honest-but-curious (following the protocol but attempting to infer private data), it cannot isolate any single client's gradient vector. This property is critical for cross-silo FL in healthcare and finance, where model updates can leak training data through gradient inversion attacks.

The protocol must complete successfully even when a subset of clients disconnect mid-round due to network instability or device unavailability. This is handled through t-out-of-n threshold secret sharing: each client splits its secret mask into shares distributed among peers. If a client drops out, the server can request the missing client's shares from a sufficient number of surviving clients to reconstruct the mask and remove it from the aggregate. This ensures synchronous rounds are not blocked by stragglers in cross-device FL deployments.

Beyond passive adversaries, secure aggregation can be hardened against active attackers who submit arbitrarily corrupted updates. Techniques include Byzantine-robust aggregation rules (e.g., Krum, trimmed mean) applied over the encrypted domain, and zero-knowledge range proofs that verify a client's update falls within expected statistical bounds without revealing the update itself. This prevents model poisoning attacks where a single malicious client could corrupt the global model by submitting extreme gradient values.

Secure aggregation introduces communication overhead from secret sharing and key exchange. Optimized protocols use pseudorandom generators to expand short seeds into full mask vectors, reducing the payload size. Gradient compression techniques like quantization and sparsification are applied before encryption to shrink updates. In over-the-air computation (AirComp) scenarios, the physical layer's waveform superposition property can compute the sum directly, eliminating the need for explicit cryptographic masking and dramatically reducing bandwidth requirements.

A forward-secrecy property ensuring that if the aggregation server is compromised at time T, it cannot retroactively decrypt model updates from rounds completed before T. This is achieved through ephemeral key pairs generated fresh for each training round and discarded immediately after aggregation. Combined with differential privacy noise added locally by clients, this creates a defense-in-depth privacy posture where even a full server breach yields only noisy, aggregated historical data rather than individual training samples.

Clients must be assured that the server correctly aggregated their encrypted contributions without tampering. This is provided through publicly verifiable proofs where the server publishes a commitment to the aggregation result along with a zero-knowledge proof that the computation was performed honestly. In blockchain-coordinated FL, the aggregation logic is executed as a smart contract, making the computation transparent and auditable by all participants. This addresses the honest-but-curious threat model by removing the need to trust the server entirely.

Exploits the waveform superposition property of a wireless multiple-access channel to compute mathematical functions during simultaneous transmission. Instead of orthogonal access, clients transmit analog signals that naturally sum in the air. This aligns perfectly with secure aggregation because the channel itself performs the summation, dramatically reducing communication latency. The server receives a noisy but direct function of all updates, which can be protected with additional privacy-preserving noise.

A foundational cryptographic technique where each client's model update is masked with pairwise random seeds. Clients exchange secrets with a subset of peers before training. During aggregation, these masks cancel out when all updates are summed, revealing only the aggregate. This protects against the honest-but-curious server threat model. Key protocols include:

• Double masking to handle dropped clients
• Shamir's secret sharing for threshold recovery
• Diffie-Hellman key exchange for pairwise seed agreement

Secure aggregation alone prevents the server from seeing individual updates, but the global model itself can leak information through its parameters. Combining secure aggregation with differential privacy provides a dual-layer defense. Clients add calibrated Gaussian noise to their updates before encryption, ensuring the aggregate has a formal privacy guarantee (ε, δ). This defends against model inversion attacks and membership inference even after the model is deployed.

Wireless edge devices frequently disconnect due to mobility, power constraints, or channel fading. Secure aggregation protocols must handle stragglers and dropouts without stalling the entire round. Techniques include:

• Threshold secret sharing allowing recovery if a minimum number of clients respond
• Asynchronous aggregation where the server proceeds with available updates
• Gradient coding that introduces redundancy to reconstruct missing contributions This is critical for cross-device federated learning at scale.

In adversarial wireless environments, malicious clients may upload poisoned updates to corrupt the global model. Secure aggregation must be paired with Byzantine-resilient aggregation rules that are computed over encrypted data. Approaches include:

• Krum and multi-Krum selecting updates closest to the geometric median
• Trimmed mean discarding extreme values before averaging
• Coordinate-wise median replacing the mean with the median per parameter These operate on masked data, requiring careful cryptographic protocol design.

Transmitting full model updates over bandwidth-limited wireless links is prohibitive. Secure aggregation is combined with gradient compression techniques:

• Sparsification transmitting only the top-k gradient components
• Quantization reducing each value to 1-4 bits
• Low-rank decomposition factorizing weight matrices before transmission The challenge is performing these lossy operations on encrypted data. Homomorphic encryption enables addition on compressed ciphertexts, while sketching techniques approximate aggregates with sublinear communication.