Source-linked AI summary
Aggregation Service for Federated Learning: An Efficient, Secure, and More Resilient Realization
Yifeng Zheng, Shangqi Lai, Yi Liu, Xingliang Yuan, Xun Yi, Cong Wang
TL;DR
Shared model updates can still leak private information, and existing secure aggregation leaves gaps in lightweight dropout-resilient processing and server integrity. The paper combines secure aggregation with quantization and integrity protections; it reports accuracy comparable to plaintext baselines and practical performance across benchmark datasets.
Problem
Shared model updates still pose privacy risks, while prior work leaves gaps in dropout-resilient aggregation, encrypted-domain communication efficiency, and protection against an actively adversarial server.
Source: §1 · pp. 1–2Method
The system uses lightweight secure aggregation that keeps dropout clients’ keys private, integrates quantization, and protects cloud-side computation integrity.
Source: §1 · p. 2, §9 · p. 13Results
The system achieves accuracy comparable to the plaintext baseline across benchmark datasets; server aggregation is up to 39× more efficient at zero drop-out and incurs at most 2.3× computation overhead under varying drop-out rates versus.
Source: §1 · p. 2Takeaways & Limitations
Dropout clients can safely participate in later rounds without exposing their secret keys or requiring a new key setup.
Source: §1 · p. 2The system does not protect aggregate model updates or the global model; poisoning and backdoor attacks are outside the work’s scope.
Source: §4.2 · p. 5
Abstract
from arXiv · showhide
Federated learning has recently emerged as a paradigm promising the benefits of harnessing rich data from diverse sources to train high quality models, with the salient features that training datasets never leave local devices. Only model updates are locally computed and shared for aggregation to produce a global model. While federated learning greatly alleviates the privacy concerns as opposed to learning with centralized data, sharing model updates still poses privacy risks. In this paper, we present a system design which offers efficient protection of individual model updates throughout the learning procedure, allowing clients to only provide obscured model updates while a cloud server can still perform the aggregation. Our federated learning system first departs from prior works by supporting lightweight encryption and aggregation, and resilience against drop-out clients with no impact on their participation in future rounds. Meanwhile, prior work largely overlooks bandwidth efficiency optimization in the ciphertext domain and the support of security against an actively adversarial cloud server, which we also fully explore in this paper and provide effective and efficient mechanisms. Extensive experiments over several benchmark datasets (MNIST, CIFAR-10, and CelebA) show our system achieves accuracy comparable to the plaintext baseline, with practical performance.
1 INTRODUCTION
The paper addresses privacy risks in shared model updates alongside gaps in lightweight aggregation, dropout resilience, encrypted-domain communication efficiency, and protection against an actively adversarial server. It proposes secure aggregation with quantization and server-side computation integrity, and reports comparable accuracy and practical performance.
1 INTRODUCTION
- Prior secure aggregation leaves model-update privacy risks, while practical dropout handling, encrypted-domain communication efficiency, and active-server integrity remain unresolved gaps.The cited prior dropout approach can prevent affected clients from safely joining future rounds without a new key setup.Source: §1 · p. 1
- The proposed system lets clients send obscured updates for cloud aggregation, preserving dropout clients’ secret keys so they can participate safely in later rounds.It builds on an aggregation protocol intended to avoid expensive cryptographic operations throughout federated learning.Source: §1 · pp. 1–2
- Quantization is integrated with secure aggregation to reduce communication without de-quantizing updates before aggregation, with overflow and negative-value handling addressed.The selected technique supports summation of quantized updates directly.Source: §1 · p. 2
- The system uses trusted execution techniques to protect server-side computation integrity against an actively adversarial cloud server.The design relies on integrity rather than trusted hardware’s confidentiality guarantee.Source: §1 · p. 2
- Experiments on MNIST, CIFAR-10, and CelebA report accuracy comparable to the plaintext baseline, including with quantized updates, and practical client-side security costs.Encryption and dropout handling take a few seconds for MNIST and a few minutes for the larger CIFAR-10 and CelebA models.Source: §1 · p. 2
- Up to 39× greater efficiency under zero client drop-out and at most 2.3× computation overhead under varying drop-out rates are reported against.The system also incurs almost no server-side aggregation overhead over the semi-honest setting.Source: §1 · p. 2
2 RELATED WORK
Related work spans secure aggregation, dropout resilience, and hardware-assisted integrity. The paper contrasts its design with prior systems that rely on expensive cryptography or additional assumptions, and positions integrity-only trusted hardware as a distinct design choice.
2 RELATED WORK
- Homomorphic-encryption approaches can impose high overhead and require shared keys, secret-sharing protocols, or a trusted third party; this system avoids a TTP.Xu et al. use functional encryption and require a TTP for setup and learning.Source: §2 · p. 3
- Bonawitz et al. offer lightweight encryption and dropout handling but expose dropout clients’ keys, limiting their safe direct participation in later rounds without new setup.Follow-up works add client-topology assumptions or balance privacy, efficiency, and dropout tolerance; the latter is limited to a preset fraction.Source: §2 · p. 3
- Unlike, this protocol keeps dropout clients’ keys secret and needs one additional interaction round for dropout handling; it also targets server computation integrity.The paper notes that repeated setup interactions can hinder or abort an iteration when dropouts exceed a threshold.Source: §2 · p. 3
- The system assumes trusted hardware integrity without relying on its confidentiality guarantee, which may be threatened by side-channel attacks.The paper distinguishes its focus on protecting individual model updates from orthogonal differential-privacy techniques and from work focused on hiding models from clients.Source: §2 · p. 3
3 PRELIMINARIES
The preliminaries describe federated learning as repeated local training followed by server aggregation, and introduce transparent enclaves as a minimal trust model for protected computation.
3.1 Federated Learning
- Federated learning formulates joint optimization over data owners’ local datasets, with each owner sharing updates that a server aggregates iteratively.Each round selects clients, sends them the current global model, and aggregates their locally trained updates for the next round.Source: §3.1 · p. 4
- In each round, selected owners train locally—often with SGD—and share updates that contribute to the next global model.The server selects a fraction of data owners and sends the current model before local training.Source: §3.1 · p. 4
3.2 Transparent Enclave
- A transparent enclave assumes the host can see enclave states but retains secure code attestation and secure signing functionality.This approach relies on computational integrity rather than confidentiality, which the passage says may be compromised by side-channel attacks.Source: §3.2 · p. 4
4 SYSTEM OVERVIEW
The overview frames a service connecting a requester and clients, with clients sharing obscured, quantized updates for server aggregation. It also specifies confidentiality and computation-integrity goals alongside threat boundaries.
4.1 Architecture
- A requester releases a task through the service, which connects it to participating clients that agree on a common model architecture and learning objective.The service may be hosted on a cloud server, which can be a server or a cluster of servers.Source: §4.1 · p. 4
- Clients share obscured, quantized model updates so the cloud server can aggregate without seeing individual updates in the clear.The design avoids expensive homomorphic encryption and uses quantization to compress updates.Source: §4.1 · p. 4
- The design targets computation integrity at the cloud server using a transparent enclave and minimally trusted hardware with integrity guarantees.The paper contrasts this pragmatic approach with theoretically possible, expensive cryptography-based verifiable computation.Source: §4.1 · pp. 4–5
4.2 Threat Model
- The threat model includes semi-honest servers curious about individual updates and stronger servers that may not follow the designated computation.The server is intended to learn only an aggregate model update and the global model while preserving individual-update confidentiality.Source: §4.2 · p. 5
- Confidentiality against server collusion with selected clients is scoped to settings with at least one honest client; the extreme all-but-one collusion case is unprotected.In that extreme case, colluding clients’ data can be removed from the sum, revealing the honest client’s data.Source: §4.2 · p. 5
- The system does not protect aggregate model updates or the global model from attacks; client noise addition using complementary differential privacy can mitigate this boundary.Poisoning and backdoor attacks are outside the scope of the work.Source: §4.2 · p. 5
5 EMPOWERING FEDERATED LEARNING WITH SECURE AND EFFICIENT AGGREGATION
The design combines lightweight secure aggregation with protection against client drop-outs and a cloud server that may collude with some clients. Its practical mechanisms address drop-out recovery, client changes, and scaling client-side work through grouping.
5.1 Overview
- The overview adopts a low-overhead aggregation protocol that avoids heavy cryptographic operations and does not reveal drop-out clients' secret keys.This is intended to let those clients participate directly in later rounds without a new key setup.Source: §5.1 · p. 5
5.2 Protocol
- Clients mask model updates with pairwise blinding factors that cancel when selected clients' obscured updates are summed.Fractional updates are scaled into integers for cryptographic computation and reconstructed after aggregation; the message space must be sufficiently large.Source: §5.2 · pp. 5–6
5.3 Security Guarantees
- Under the CDH assumption, the cloud learns only the aggregate update, while honest clients' updates remain protected even if the server colludes with a subset of clients.The proof concludes that honest-client updates remain randomly masked by blinding factors shared with other honest clients.Source: §5.3 · p. 6
5.4 Practical Considerations
- Responding clients remove mask contributions from clients that dropped out, allowing the remaining obscured updates to be correctly aggregated.The mechanism assumes responding clients remain online for potential assistance; joining clients publish keys for current clients to derive shared keys, while departing clients' keys are discarded.Source: §5.4 · p. 7
- Grouping selected clients reduces each participant's computation complexity to O(|T|/s), while faults in one group do not affect other groups.The trade-off is that the server learns aggregated updates for independent groups, though individual updates within each group remain protected.Source: §5.4 · p. 7
6 LEVERAGING QUANTIZATION FOR BOOSTED COMMUNICATION EFFICIENCY
The section uses quantization to reduce communication while keeping aggregation compatible with the secure protocol. It adapts a signed quantizer and addresses practical bounds, overflow, and modular recovery.
6 LEVERAGING QUANTIZATION FOR BOOSTED COMMUNICATION EFFICIENCY
- Quantizing model updates reduces communication costs and represents values as integers that are compatible with cryptographic aggregation.The section selects quantization because existing techniques often require de-quantization before aggregation, which is more complex than secure aggregation.Source: §6 · p. 7, §6.1 · p. 7
6.1 Quantization Technique
- The integrated r-bit quantizer maps values in [−B, B] to signed integers in [−(2^r−1−1), 2^r−1−1], with a symmetric range for opposite-sign cancellation.The technique is adapted from prior work.Source: §6.1 · pp. 7–8
6.2 Secure Federated Learning with Quantization
- Each selected client sends an obscured quantized model difference, which the cloud aggregates before producing an updated global model.Quantization applies to the difference between the locally trained model and the previous global model; values are clipped to [−B, B].Source: §6.2 · p. 8
- For aggregation over c clients, scaling the input range to [−c·B, c·B] prevents overflow, and values above 2^r−1−1 are converted to negative representatives before de-quantization.The server applies a modulo-based check to identify negative aggregate values before de-quantizing.Source: §6.2 · p. 8
7 HARDENING SECURE FEDERATED LEARNING
The section hardens secure federated learning against an actively adversarial cloud server by requiring verifiable computation outputs. It describes an abstract trusted-hardware functionality and an Intel SGX realization.
7 HARDENING SECURE FEDERATED LEARNING
- The hardened design targets an actively adversarial cloud server and uses trusted hardware with a minimal computation-integrity assumption.The earlier design assumes the server faithfully performs the designated computation.Source: §7 · p. 8
7.1 Abstract Functionality from Trusted Hardware
- FTEE installs a program and returns a signed hash token for public verification; its compute command runs the program and returns outputs with round-indexed signatures.Its stored state includes the inputs, outputs, randomness, and signatures, and is observable by the host.Source: §7.1 · pp. 8–9
7.2 Security-Hardened Federated Learning
- The protocol routes every message from the TEE-enabled server through FTEE so participants can verify signed outputs using its verification key.The requester and clients verify the installed program's signed hash before federated learning proceeds.Source: §7.2 · p. 9
7.3 Realization of the Ideal Functionality FTEE
- Intel SGX is presented as an instantiation: an enclave can generate FTEE's signing keys, and its attestation report can make the verification key public reliably.SGX enclaves isolate program execution from other applications on the host and provide program-integrity attestation.Source: §7.3 · p. 9
8 EXPERIMENTS
The experiments evaluate accuracy and client- and server-side costs across three datasets, comparing the secure design with plaintext learning and prior work. They report comparable accuracy, communication savings from quantization, and performance costs that vary with client selection and dropout.
8.1 Setup
- Experiments use MNIST, CIFAR-10, and CelebA with CNN, AlexNet, and ResNet-18 models, and evaluate plaintext, scaled secure, and quantized secure protocols.The setup distributes MNIST and CIFAR-10 data across 100 clients and uses a 70/30 train-test split for CelebA.Source: §8.1 · pp. 9–10, §8.2 · p. 10
8.3.1 Client-Side Performance
- 8-bit and 16-bit quantization reduce transferred update size by 4× and 2×, respectively, while accuracy remains comparable to plaintext.Scaling alone incurs no update-size overhead.Source: Table 3 · p. 10, §8.3.1 · p. 11
8.2 Accuracy Evaluation
- With scaling factor 107, secure protocols retain accuracy comparable to plaintext across IID datasets and non-IID MNIST, including with adequate-width quantization.The scaling-factor evaluation reports preserved accuracy as rounds grow when the factor is sufficiently large.Source: §8.2 · p. 10, Figure 4 · p. 10, Figure 5 · p. 11
8.3.1 Client-Side Performance
- Encryption takes seconds for MNIST but minutes for CIFAR and CelebA; grouping selected clients in tens can limit client complexity independently of the selected fraction.The larger models have substantially more parameters than MNIST.Source: §8.3.1 · p. 11, Figure 7 · p. 12
- Client recovery cost grows linearly with dropout rate, and client grouping greatly reduces that cost.The recovery evaluation varies dropout rates across models.Source: §8.3.1 · p. 11, Figure 8 · p. 12
8.3.2 Cloud Server-Side Performance
- Active-adversary protection adds almost no aggregation overhead: 1×, 1.005×, and 1.013× over semi-honest aggregation for MNIST, CIFAR, and CelebA, respectively.The authors attribute the minimal overhead to avoiding paging.Source: §8.3.2 · p. 11, Figure 9 · p. 12
8.3.3 Comparison with Prior Work
- At zero dropout, our design is up to 39× more efficient than, while rising-dropout client cost is limited to 2.3×.The comparison tests over varying dropout rates and fractions of selected clients.Source: §8.3.3 · pp. 11–12, Table 5 · p. 12
- Compared with, our semi-honest server uses less computation as dropout and selected-client fractions rise; complexity is O(m(n − d)) versus ’s O(m(n − d) + md(n − d)).The cited comparison attributes ’s additional server work to reconstructing secret keys and recomputing masks.Source: §8.3.3 · pp. 11–13, Table 4 · p. 11, Table 6 · p. 12
9 CONCLUSION
The paper presents a federated-learning design that protects model updates while enabling aggregation. It combines lightweight secure aggregation, dropout resilience, quantization for communication efficiency, and computation integrity at the cloud server.
9 CONCLUSION
- The design lets clients submit obscured model updates for aggregation, supports dropout without exposing clients’ secret keys, incorporates quantization, and protects computation integrity at the cloud server.The authors report practical performance in evaluations over benchmark datasets.Source: §9 · p. 13