PaperlayerView exact revision on arXiv

Source-linked AI summary

Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learning

Jinhyun So, Ramy E. Ali, Basak Guler, Jiantao Jiao, Salman Avestimehr

arXiv:2106.03328v2cs.LGcs.CRcs.DCcs.ITmath.IT

TL;DR

Partial user participation can let servers reconstruct individual models from aggregates across multiple rounds, despite single-round secure aggregation. The paper introduces a long-term privacy metric and structured user selection in Multi-RoundSecAgg. Experiments report nearly the same test accuracy as random selection while providing better long-term privacy.

  • Problem

    Conventional secure aggregation protects individual models within a round, but partial participation can expose them through aggregates observed across rounds.

    Source: §1 · p. 1, §3.2 · p. 3

  • Method

    Multi-RoundSecAgg defines long-term privacy and uses batch-based structured user selection to protect individual models over any number of rounds.

    Source: §1 · p. 2, §3.2 · p. 3, §4 · p. 5

  • Results

    Multi-RoundSecAgg achieves almost the same test accuracy as random selection while providing better long-term privacy in IID and non-IID experiments.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Stronger long-term privacy trades off with average participation and convergence, so greater privacy can require more rounds to reach the same accuracy as random selection.

    Source: §1 · p. 2

    The analysis uses a worst-case assumption that models do not change over time; when models change, the multi-round privacy guarantee becomes stronger.

    Source: §3.2 · p. 4

Abstract

from arXiv · show

Secure aggregation is a critical component in federated learning (FL), which enables the server to learn the aggregate model of the users without observing their local models. Conventionally, secure aggregation algorithms focus only on ensuring the privacy of individual users in a single training round. We contend that such designs can lead to significant privacy leakages over multiple training rounds, due to partial user selection/participation at each round of FL. In fact, we show that the conventional random user selection strategies in FL lead to leaking users' individual models within number of rounds that is linear in the number of users. To address this challenge, we introduce a secure aggregation framework, Multi-RoundSecAgg, with multi-round privacy guarantees. In particular, we introduce a new metric to quantify the privacy guarantees of FL over multiple training rounds, and develop a structured user selection strategy that guarantees the long-term privacy of each user (over any number of training rounds). Our framework also carefully accounts for the fairness and the average number of participating users at each round. Our experiments on MNIST and CIFAR-10 datasets in the IID and the non-IID settings demonstrate the performance improvement over the baselines, both in terms of privacy protection and test accuracy.

1 Introduction

Secure aggregation protects individual models within a training round, but partial participation can let a server reconstruct them from aggregates across rounds. The paper introduces Multi-RoundSecAgg to provide long-term privacy while considering selection fairness and participation levels.

1 Introduction

  • Conventional secure aggregation lets the server learn only the users’ aggregate model at any given round, not their individual models.Federated learning users share local updates rather than their underlying data.Source: §1 · p. 1
  • Random user selection can allow the server to recover all local models after enough rounds, and inversion of recovered models yields images similar in quality to originals.The authors identify partial user selection as the source of this multi-round exposure.Source: §1 · pp. 1–2
  • Multi-RoundSecAgg introduces a long-term privacy metric and structured user selection that protects individual models over any number of rounds while accounting for fairness and average participation.The method trades stronger long-term privacy for fewer average participants and potentially more rounds to reach the same accuracy as random selection.Source: §1 · p. 2
  • On MNIST, CIFAR-10, and CIFAR-100 in IID and non-IID settings, Multi-RoundSecAgg achieves almost the same test accuracy as random selection while providing better long-term privacy.Figure 1 qualitatively contrasts reconstructed images under conventional per-round secure aggregation with those under the proposed method.Source: Figure 1 · p. 1, §1 · p. 2

2 Related Work

Prior work addresses secure aggregation within individual rounds and partial participation for communication or convergence, but not privacy leakage across rounds. This paper identifies that gap and develops a long-term privacy metric and selection strategy.

2 Related Work

  • Earlier secure aggregation protocols hide individual local models behind pairwise masks, but exchanging and reconstructing keys incurs significant communication cost.More efficient protocols are described as complementary to this work and combinable with it.Source: §2 · p. 2
  • Prior partial-user selection strategies target communication bottlenecks and faster convergence, rather than privacy leakage from observing aggregates across rounds.The paper frames its contribution as addressing the privacy issue left by those lines of work.Source: §2 · p. 2
  • Previous work had not mitigated privacy leakage from partial participation and aggregate observations across rounds; this paper identifies a long-term privacy metric and provable selection strategy.The paper notes that Pejó and Biczók (2020) pointed out the problem, but did not address mitigation.Source: §2 · p. 2
  • Differential privacy can protect privacy across FL rounds at the expense of model performance, and is complementary to secure aggregation; this paper studies secure aggregation without DP.The authors note that DP can be applied by adding noise to local models.Source: §2 · p. 2

3 System Model

The section models cross-device federated learning with partial user participation, then formalizes privacy across rounds and metrics for evaluating selection strategies. It also describes baseline selection schemes.

3.1 Basic Federated Learning Model

  • In cross-device FL, a server coordinates N users’ local training and aggregates updates from K selected available users in each round.FedAvg iterates local SGD updates and server aggregation; only a fraction of users may be available in any round.Source: §3.1 · pp. 2–3

3.2 Multi-round Secure Aggregation

  • The selection algorithm chooses K users from those currently available using the participation history, and skips a round when fewer than K are available.The participation matrix records selection history; the selected users’ local models are aggregated through secure aggregation.Source: §3.2 · p. 3
  • The multi-round privacy guarantee requires every nonzero reconstructable partial sum to combine disjoint groups of at least T local models.Under the section’s worst-case assumption that models do not change across rounds, T≥2 prevents recovery of any individual model; the strongest result is a sum of two models.Source: §3.2 · pp. 3–4
  • Random selection can expose local models within a number of rounds linear in N, despite secure aggregation at each round.The section also reports that changing models across rounds strengthens the multi-round privacy guarantee, and conventional schemes leak information even in realistic settings.Source: §3.2 · p. 4
  • Evaluation metrics include the average aggregation fairness gap F and average aggregation cardinality C, which measures expected models aggregated per round.F=0 means users participate on average equally; the section reports higher accuracy for schemes with small F, while C directly controls convergence rate.Source: §3.2 · p. 4

3.3 Baseline Schemes

  • The baselines are random selection, random weighted selection favoring less-participating users, and user partitioning into groups selected as units.The grouping scheme skips a round when no group is available; when multiple groups are available, it favors a group containing a least-participating user.Source: §3.3 · p. 4

4 Proposed Scheme: Multi-RoundSecAgg

Multi-RoundSecAgg separates long-term privacy design from round-by-round user selection: it constructs privacy-preserving user-set families, then selects available sets to account for fairness. Its batch structure keeps groups of T users participating together or not at all.

Component 2: Available batch selection to guarantee fairness

  • A second component selects a set from the privacy-preserving family using available users and participation frequencies to promote fairness.When dropout rates differ, the server selects a feasible set containing a user with minimum prior participation frequency; ties are broken uniformly at random.Source: §4 · p. 5

Component 1: Batch Partitioning (BP) of the users to guarantee multi-round privacy

  • Batches of T users participate together or not at all, so the constructed family of K-user sets satisfies the desired multi-round privacy guarantee T.The family is represented by a binary matrix whose rows are the characteristic vectors of the user sets.Source: §4 · p. 5
  • For N = 8, K = 4, and T = 2, four two-user batches yield six possible sets by selecting any two batches.This example illustrates the batch-based construction of the privacy-preserving family.Source: §4 · p. 5, Figure 2 · p. 5

Component 2: Available batch selection to guarantee fairness

  • The second component is necessary for the aggregation fairness gap to go to zero.The passage links this necessity to Theorem 1 and Section 6.Source: §4 · p. 5

Proposed scheme

  • The overall design first builds a family meeting T, then selects specific sets from that family to meet fairness requirements.The two components are detailed in Algorithms 1 and 2 in Appendix D.Source: §4 · p. 5

5 Theoretical Results

The theoretical results characterize Multi-RoundSecAgg’s privacy, fairness, and aggregation cardinality, and analyze convergence under stated assumptions. They also show that stronger multi-round privacy trades off against aggregation cardinality and convergence speed.

5.1 Guarantees of Multi-RoundSecAgg

  • Multi-RoundSecAgg guarantees privacy level T and fairness gap F = 0, with average aggregation cardinality depending on the dropout probability.For equal dropout probability p, the theorem defines q = 1 − (1 − p)^T.Source: §5.1 · p. 5
  • As T increases, average aggregation cardinality C decreases, requiring more training rounds to reach the same accuracy.The theorem’s convergence rate matches random selection when C = K; lower C slows convergence.Source: §5.1 · p. 5, §5.2 · p. 6
  • The privacy criterion’s protection also holds against nonlinear reconstruction because users in each batch always participate together or not at all.The authors state the batch-partitioning structure is necessary for the privacy criterion and that their design achieves the largest number of distinct sets under the stated conditions.Source: §5.1 · pp. 5–6

5.2 Convergence Analysis of Multi-RoundSecAgg

  • The convergence theorem assumes equal user dropout rates; unequal rates make guarantees challenging because frequency-based selection breaks conditional unbiasedness.The authors report empirical convergence with different dropout rates.Source: §5.2 · p. 6

6 Experiments

Experiments compare six selection schemes on MNIST, CIFAR-10, and CIFAR-100, evaluating privacy, fairness, aggregation cardinality, and test accuracy. Multi-RoundSecAgg improves privacy over random selection while generally retaining comparable accuracy, with results depending on the IID or non-IID setting.

Experimental setup

  • The experiments use 120 users with 12 selected per round and evaluate IID and Dirichlet-partitioned non-IID data, with κ = 0.5 for the latter.The evaluation includes CNNs on MNIST, CIFAR-10, and CIFAR-100; CIFAR-100 uses VGG-11.Source: §6 · pp. 6–7

Key metrics

  • Multi-RoundSecAgg at T = 3 or T = 4 improves privacy over random and weighted-random selection while achieving almost the same average aggregation cardinality.Figure 5(a) illustrates the privacy–cardinality trade-off; Figure 4 presents key metrics for N = 120 and K = 12.Source: Figure 5 · p. 7, Figure 4 · p. 7, §6 · p. 8

Key Metrics versus Test Accuracy

  • In IID settings, Multi-RoundSecAgg has test accuracy comparable to random and weighted-random selection while providing higher privacy; in non-IID settings, it outperforms random selection and has a smaller fairness gap.The reported privacy levels are T = 3, 4, and 6 for Multi-RoundSecAgg, versus T = 1 for random and weighted-random selection.Source: §6 · p. 8
  • User partitioning has the worst accuracy in both IID and non-IID settings, alongside much lower average aggregation cardinality than the other schemes.The authors link this comparison to Figure 4(c).Source: Figure 4 · p. 7, §6 · p. 8

7 Conclusion

The conclusion frames Multi-RoundSecAgg as a structured selection strategy for long-term privacy that also accounts for fairness and participation cardinality. Across the evaluated datasets and IID and non-IID settings, it reports accuracy comparable to random selection while preserving long-term privacy.

Conclusion

  • Multi-RoundSecAgg’s experiments cover CIFAR-100, CIFAR-10, and MNIST in IID and non-IID settings, with accuracy comparable to random selection while ensuring long-term privacy.The conclusion also identifies a trade-off between long-term privacy and convergence rate.Source: §7 · p. 8
  • The proposed structured user selection strategy accounts for fairness and the average number of participating users while guaranteeing long-term privacy.Source: §7 · p. 8
  • The paper identifies partial participation as a privacy risk even when secure aggregation is used at every round.Source: §7 · p. 8

A Theoretical Guarantees of Multi-RoundSecAgg: Proof of Theorem 1

The proof establishes Multi-RoundSecAgg’s multi-round privacy guarantee and zero aggregation fairness gap, and characterizes its average aggregation cardinality.

A Theoretical Guarantees of Multi-RoundSecAgg: Proof of Theorem 1

  • Multi-RoundSecAgg achieves multi-round privacy T by restricting the linear combinations of each batch’s aggregated models.The proof partitions B and X into batches and examines X⊤B⊤z for nonzero z.Source: A Theoretical Guarantees of… · pp. 11–12
  • The aggregation fairness gap is F = 0 because users have equal expected selection counts, including across different batches.Users within a batch participate together, and the protocol’s symmetry gives equal expected selections across batches.Source: A Theoretical Guarantees of… · p. 12
  • The proof characterizes average aggregation cardinality using q = 1 − (1 − p)^T, the probability that a batch is unavailable.The excerpt identifies q but does not provide the full cardinality expression.Source: A Theoretical Guarantees of… · p. 12

B Convergence Analysis of Multi-RoundSecAgg : Proof of Theorem 2

The proof analyzes convergence through local-update and global-model sequences, establishes why batch partitioning is needed for privacy, and describes the protocol’s two algorithmic components.

B Convergence Analysis of Multi-RoundSecAgg : Proof of Theorem 2

  • The convergence proof analyzes local updates with virtual sequences, then bridges them to the global model; selection is unbiased at synchronization steps.The step index advances only when the server does not skip selection; the proof also states that users have identical sampling probabilities by symmetry.Source: B Convergence Analysis of… · pp. 12–13

C Necessity of Batch Partitioning (BP)

  • Batch partitioning is necessary for multi-round privacy T, and the strategy is optimal in the number of distinct user-selection sets.The proof groups users by equivalent linear functions, with each nonzero group requiring at least T users.Source: C Necessity of Batch Partitioning (BP) · pp. 13–14

D The Two Components of Multi-RoundSecAgg : Algorithms 1 and 2

  • The algorithms partition N users into N/T groups and generate selection sets by taking unions of K/T groups.Algorithm 1 outputs a privacy-preserving family of sets; the excerpt describes this batch-partitioning component.Source: D The Two Components of… · p. 14

E Additional Experiments: MNIST dataset

Across MNIST and CIFAR-10 settings, Multi-RoundSecAgg maintains comparable accuracy to random-selection baselines in IID data and performs better than random selection in non-IID data. The experiments also report that user partitioning has the worst accuracy, while the accompanying details specify the evaluation setups.

E Additional Experiments: MNIST dataset

  • In IID settings, Multi-RoundSecAgg has test accuracy comparable to random and weighted-random selection while providing better multi-round privacy; in non-IID settings, it outperforms random selection and matches weighted random.The non-IID comparison is attributed in the text to better aggregation fairness gaps.Source: Figure 6 · p. 15, Figure 7 · p. 15, E Additional Experiments: MNIST dataset · p. 16
  • The user partitioning scheme has the worst test accuracy in both IID and non-IID settings, alongside much smaller average aggregation cardinality.The experiments cover MNIST and CIFAR-10 with CNN and LeNet models, respectively.Source: E Additional Experiments: MNIST dataset · pp. 14–16

F Experiment Details

  • Test accuracies are averaged over five random seeds, with learning rates selected from seven candidates and dataset-specific batch sizes and decay schedules.MNIST uses batch size 100 without learning-rate decay; CIFAR-10 uses batch size 50 with decay every 400 and 800 rounds.Source: F Experiment Details · p. 16

G Additional Experiments: Ablation Study

The ablation varies the system parameters and compares test accuracy and privacy, while the appendix analyzes how random selection can permit reconstruction of individual models. The theoretical results assume fixed user models across rounds.

G Additional Experiments: Ablation Study

  • For (N, K) = (240, 12) and (120, 24), Multi-RoundSecAgg has accuracy comparable to random-selection schemes and better multi-round privacy; user partitioning performs worst.At (N, K) = (120, 24), user partitioning fails to train because the probability that all partitions are unavailable each round becomes almost one.Source: G Additional Experiments: Ablation Study · p. 17, Figure 8 · p. 17

H Multi-round Privacy Analysis of the Conventional Random User Selection Strategies

H.1 Theoretical Analysis of the Random Selection Strategies

  • For K-uniform selection with min(K, N − K) ≥ cN, reconstruction after N rounds has probability at least 1 − 2e^(−c′N); for IID selection, the probability converges to 1 exponentially fast when t = K/N is fixed in (0, 1/2).The result concerns full rank of the participation matrix, which implies reconstructability.Source: §H.1 · p. 18

H.2 Experimental Results

In the CIFAR-10 non-IID LeNet experiment, gradient-reconstruction results differed between K-uniform random selection and Multi-RoundSecAgg (T = 2). Image inversion also showed more information leakage under random selection (T = 1) than under Multi-RoundSecAgg (T = 2, 4).

H.2 Experimental Results

  • The gradient-reconstruction experiment uses N = 40 users, K = 8 selections per round, and LeNet training on non-IID CIFAR-10.The reconstruction algorithm uses least squares and measures L2 distance between true and reconstructed gradients.Source: §H.2 · p. 18
  • For Multi-RoundSecAgg (T = 2), the server cannot estimate individual gradients using (32) because the participation matrix is not full rank.The inverse of P(t0;t1)⊤P(t0;t1) therefore does not exist.Source: §H.2 · pp. 18–19
  • 6.715×10^-3 for K(= 8)-uniform random selection versus 0.7829 for Multi-RoundSecAgg (T = 2) average reconstruction error; the caption says random-selection updates can be reconstructed, but Multi-RoundSecAgg updates cannot.Figure 9 reports the error values and their implications for reconstruction.Source: Figure 9 · p. 19, §H.2 · p. 19
  • Random selection (T = 1) leaks more information about original images than Multi-RoundSecAgg (T = 2, 4) in the model-inversion comparison.The comparison uses PSNR and MSE, with higher PSNR and lower MSE indicating greater similarity between reconstructed and original images.Source: Figure 10 · p. 19, §H.2 · p. 19

Related papers

Loading 2106.03328v2…