Secure Multi-Party Computation

The fundamental guarantee of MPC. A protocol ensures privacy if, at the end of the computation, no party learns anything more about another party's private input than what can be inferred from the final output and their own input. This is formally defined using simulation-based security, where an adversary's view of the protocol can be simulated without access to the honest parties' secrets. For example, in a private salary comparison, two executives learn only who has the higher salary, not the exact figures.

The protocol must guarantee that the computed output is accurate according to the predefined function, even in the presence of malicious participants who may deviate from the protocol. This is often broken into two sub-properties:

• Consistency: All honest parties receive the same output.
• Validity: The output corresponds to the result of applying the function to the valid inputs provided by the honest parties. Robust MPC protocols achieve guaranteed output delivery, ensuring the computation completes correctly for all honest parties, while fairness ensures that if one party receives the output, all parties do.

The security of an MPC protocol is defined relative to a specific adversarial model, which specifies the adversary's capabilities. The two primary models are:

• Semi-Honest (Passive) Adversaries: Corrupted parties follow the protocol but try to learn extra information from the messages they receive. This model is easier to achieve and is common in privacy-focused applications.
• Malicious (Active) Adversaries: Corrupted parties can arbitrarily deviate from the protocol—sending wrong messages, aborting early, or injecting false data. Protocols secure against malicious adversaries are more complex and require additional cryptographic machinery like zero-knowledge proofs or commitment schemes.

A critical practical property. MPC protocols are evaluated by their asymptotic complexity in terms of:

• Round Complexity: The number of sequential communication rounds required. Constant-round protocols (e.g., using Garbled Circuits) are essential for low-latency networks.
• Communication Complexity: The total amount of data exchanged between parties, often the primary bottleneck in wide-area networks.
• Computational Complexity: The local computation required by each party. Some protocols, like those based on Secret Sharing, shift burden from computation to communication. The choice of MPC paradigm (e.g., Garbled Circuits vs. Secret Sharing) directly trades off these complexities.

Most MPC protocols rely on a threshold assumption regarding the number of corrupt parties. A common formulation is the t-out-of-n threshold: the protocol remains secure as long as the number of corrupted parties is less than t. The value of t defines the security-resilience trade-off:

• Honest Majority (t < n/2): Often required for information-theoretic security (unconditional, without cryptographic assumptions).
• Dishonest Majority (t < n): Allows for corruption of all but one party but typically requires cryptographic assumptions (e.g., the hardness of factoring). Protocols like SPDZ operate in this stronger model.

A strong security framework that guarantees an MPC protocol remains secure even when run concurrently with other arbitrary protocols or multiple instances of itself. A Universally Composable (UC) secure protocol ensures security in complex, real-world environments. Achieving UC security often requires a common reference string (CRS) or other setup assumptions. This property is crucial for deploying MPC as a modular component within larger, interconnected systems where security cannot be analyzed in isolation.

Banks and financial institutions use MPC to jointly compute risk scores and detect fraud patterns without exposing individual customer transaction histories. This allows for:

• Cross-institutional fraud detection: Identifying coordinated attacks across multiple banks.
• Creditworthiness assessment: Computing aggregate statistics for loan applicants using data from multiple lenders.
• Anti-money laundering (AML): Analyzing transaction networks while keeping individual links private. A consortium can compute the total exposure to a specific counterparty without any single bank revealing its proprietary position.

Hospitals and research centers employ MPC to train predictive models on combined patient datasets for disease research while complying with regulations like HIPAA and GDPR. Key uses include:

• Genome-wide association studies (GWAS): Identifying genetic markers for diseases using data from multiple biobanks.
• Clinical trial matching: Finding eligible patients across institutions without sharing full medical records.
• Epidemiological modeling: Analyzing infection spread patterns from localized health data. This enables breakthroughs in precision medicine by creating models on larger, more diverse datasets than any single entity possesses.

MPC protocols enable secure computation of advertising metrics like conversion rates and attribution without leaking user-level data between advertisers, publishers, and platforms. This facilitates:

• Conversion lift measurement: Determining ad effectiveness without revealing which specific users converted.
• Frequency capping: Ensuring users don't see the same ad too often across different sites.
• Secure audience segmentation: Computing aggregate demographics for ad targeting. This moves the industry beyond third-party cookies while maintaining campaign measurability.

MPC augments federated learning by providing cryptographic guarantees beyond the averaging of model updates. It enables:

• Secure model aggregation: The server learns only the final aggregated model update, not individual contributions.
• Private prediction: Models hosted by multiple parties can jointly make a prediction on a client's private input.
• Verifiable training: Clients can cryptographically prove they performed training correctly without revealing their data. This is critical for highly regulated verticals like healthcare and finance where even model gradients may contain sensitive information.

A specific cryptographic protocol, often built using MPC techniques, used to compute the sum of model updates from multiple clients in federated learning without the central server learning any individual client's contribution.

• Core Use Case: It is the most direct application of MPC in private ML. The server only learns the aggregated model update, preventing it from inferring individual data points from a client's gradient. This protects against privacy attacks like model inversion or membership inference during the federated averaging process.

A distributed deep learning technique where a neural network is vertically split between a client and a server. The client computes the initial layers on its raw data and sends the intermediate activations (called smashed data) to the server, which completes the forward and backward pass.

• Privacy Trade-off: Split learning reduces client compute and exposes only intermediate features, not raw data. However, these features can still be sensitive. MPC can be integrated into the split learning framework to cryptographically secure the transmission and processing of the smashed data between the client and server, closing this privacy gap.