Source-linked AI summary
Privacy-Preserving Aggregation in Federated Learning: A Survey
Ziyao Liu, Jiale Guo, Wenzhuo Yang, Jiani Fan, Kwok-Yan Lam, Jun Zhao
TL;DR
Privacy-preserving aggregation is central to federated learning, but the literature lacks a comprehensive survey focused on its protocols in FL systems. This paper reviews their constructions, supporting frameworks, trade-offs, challenges, and future directions, concluding that scalability remains constrained by costly cryptographic computation and communication.
Problem
The literature lacks a comprehensive survey organized around privacy-preserving aggregation protocols used in federated learning.
Method
The paper surveys PPAgg constructions, supporting cryptographic tools, open-source FL frameworks, application scenarios, advantages, disadvantages, challenges, and future directions.
Results
The survey analyzes diverse PPAgg protocols and identifies throughput limitations caused by generic cryptographic building blocks with substantial computation or communication overhead.
Takeaways & Limitations
PPAgg selection should be matched to FL settings, threat models, resource requirements, and deployment scale.
Takeaways & Limitations
Pair-wise masking can require O(n2) communication rounds for key exchange, making SecAgg not cost-effective for large-scale FL applications.
Abstract
from arXiv · showhide
Over the recent years, with the increasing adoption of Federated Learning (FL) algorithms and growing concerns over personal data privacy, Privacy-Preserving Federated Learning (PPFL) has attracted tremendous attention from both academia and industry. Practical PPFL typically allows multiple participants to individually train their machine learning models, which are then aggregated to construct a global model in a privacy-preserving manner. As such, Privacy-Preserving Aggregation (PPAgg) as the key protocol in PPFL has received substantial research interest. This survey aims to fill the gap between a large number of studies on PPFL, where PPAgg is adopted to provide a privacy guarantee, and the lack of a comprehensive survey on the PPAgg protocols applied in FL systems. In this survey, we review the PPAgg protocols proposed to address privacy and security issues in FL systems. The focus is placed on the construction of PPAgg protocols with an extensive analysis of the advantages and disadvantages of these selected PPAgg protocols and solutions. Additionally, we discuss the open-source FL frameworks that support PPAgg. Finally, we highlight important challenges and future research directions for applying PPAgg to FL systems and the combination of PPAgg with other technologies for further security improvement.
1 INTRODUCTION
Federated learning enables distributed model training while preserving data privacy, but its heterogeneous participants and threat models require specialized privacy-preserving aggregation. This survey addresses the lack of a comprehensive aggregation-focused review by organizing protocols, applications, and future directions.
- Federated learning lets distributed data owners jointly train models while keeping their data private.
- PPFL aggregation must accommodate heterogeneous computational and bandwidth resources, participant dropouts, and more complex privacy and security threats than standard PPML.
- Existing surveys cover FL, threats and defenses, PPFL applications, or edge integration, but do not extensively compare aggregation constructions and threat models.
- The survey classifies related work by its main privacy-preserving technique because individual aggregation protocols may combine multiple techniques.
- The paper reviews PPAgg constructions, supporting tools, open-source FL frameworks, challenges, and future research directions.
2 OVERVIEW AND FUNDAMENTALS OF FEDERATED LEARNING
Federated learning repeatedly trains local models, uploads them, aggregates them centrally, and distributes the updated global model. Its heterogeneous settings and insider or outsider threats create distinct privacy requirements for user and global models.
- FL architecture: A standard FL system has local users train models on private datasets, while a central server aggregates them into a global model.
- FL workflow: The training loop repeats local training, model uploading, server-side aggregation, and global-model distribution until training stops.
- FL settings: PPAgg designs must account for heterogeneous data formats, computational power, bandwidth, and cross-silo or cross-device deployment settings.
- Adversary models: Threats may involve single or colluding adversaries, including users, servers, third parties, eavesdroppers, passive malicious actors, and active malicious actors.
- Privacy threats: FL privacy threats include leakage from users’ local models and exposure of global models, requiring protection for both.
3 TECHNIQUES FOR PRIVACY-PRESERVING AG-
This section surveys cryptographic and privacy techniques used to construct privacy-preserving aggregation in federated learning, including masking, homomorphic encryption, secure computation, differential privacy, and trusted execution environments.
- 3.1 One-time Pad: One-Time Pad masking encrypts messages with one-use random keys and can provide unconditional security over finite fields.In FL, masking preserves privacy, but aggregation protocols must cancel the masks to recover correct results.
- 3.1 One-time Pad: OTP-based aggregation provides exact results, whereas differential-privacy aggregation introduces noise and can degrade FL model performance.Fixed-point FL values must first be converted into finite-field elements for unconditional OTP security.
- 3.2 Homomorphic Encryption: Homomorphic-encryption schemes range from single-operation PHE to limited-operation SWHE and unrestricted FHE, with efficiency generally decreasing across these categories.Threshold and multi-key variants distribute secret keys among participants, requiring corruption of more participants to break security.
- 3.2 Homomorphic Encryption: Because FL aggregation mainly requires addition, partially homomorphic encryption is the natural homomorphic-encryption option, with Paillier widely used for encrypted summation.Fully homomorphic encryption is used when privacy-preserving training requires broader encrypted computation; CKKS offers a commonly used efficiency–accuracy trade-off.
- 3.3 Secure Multi-Party Computation: Secure multi-party computation encompasses cryptographic techniques for privacy-preserving function evaluation, including homomorphic encryption, garbled circuits, oblivious transfer, and secret sharing.Secret sharing distributes a secret among parties so that a threshold number can reconstruct it, while smaller subsets learn nothing.
- 3.4 Differential Privacy: Differential privacy protects individual participants by randomizing outputs, while its privacy budget controls the privacy–utility trade-off.GDP-based aggregation can use less noise than LDP at the same privacy level but requires a trusted server or trusted third party; LDP is more practical but does not restrict property-inference attacks.
- 3.6 Trusted Execution Environment: Trusted execution environments use hardware enclaves such as Intel SGX and ARM TrustZone, but their security level trades off against computational resources and hardware cost.The added hardware cost may hinder large-scale deployment.
4 PRIVACY-PRESERVING AGGREGATION PROTOCOLS IN FEDERATED LEARNING
This section surveys masking-, homomorphic-encryption-, MPC-, and differential-privacy-based aggregation protocols, analyzing their constructions, deployment trade-offs, and privacy limitations in federated learning.
- Masking-based Aggregation: Masking-based protocols protect user models through pair-wise or non-pair-wise masks that are canceled during aggregation, with secret sharing supporting dropout handling.Pair-wise schemes use seed agreement and pseudorandom generation, while one-shot unmasking reduces interactions but changes deployment trade-offs.
- Masking-based Aggregation: O(n log n) communication can replace SecAgg’s O(n^2) complexity when sparse random graphs provide a security guarantee similar to the complete graph.CCESA uses an Erdős–Rényi graph, where the connection probability trades security level against protocol efficiency.
- Multi-round Privacy: Multi-round FL can still leak information because changing user participation may expose differences between users’ models across rounds.The cited example involves users participating in overlapping but different rounds, even when privacy-preserving aggregation is used.
- Deployment Trade-offs: Masking protocols suit cross-device settings with dropout resilience, whereas one-shot unmasking is usually more efficient for cross-silo settings.The survey identifies a trade-off between security assumptions, such as trusted parties or non-collusion, and computation, communication, or storage costs.
- Other Aggregation Approaches: HE, MPC, and DP provide alternative aggregation approaches, but they introduce distinct costs or limitations involving key management, online participants, or model-performance loss.HE may require expensive public-key generation and ciphertext training; MPC can require trusted or non-colluding participants; DP adds noise that affects model performance.
- Survey Scope: The survey organizes PPAgg constructions by threat model, resource requirements, and deployment scale to guide privacy-preserving FL design.It presents these properties as a reference for readers designing schemes for specific FL settings.
5 FEDERATED LEARNING FRAMEWORKS FOR PRIVACY-PRESERVING AGGREGATION
The survey identifies open-source FL frameworks that support privacy-preserving aggregation and summarizes their protocols, privacy guarantees, and threat models, while noting additional frameworks under development or restricted licensing.
- Table 4 lists open-source FL frameworks supporting privacy-preserving aggregation, including their protocol constructions, privacy guarantees, and threat models.
- Additional frameworks are under development from companies and organizations, while some others use proprietary or limited licenses.
6 CHALLENGES AND FUTURE DIRECTIONS
The survey highlights throughput, security, and privacy challenges that remain in privacy-preserving FL, and outlines lightweight cryptography, batch processing, and hybrid security schemes as research directions.
- Many PPAgg protocols have limited throughput because generic cryptographic building blocks impose substantial computation or communication overheads.
- Lightweight aggregation-specific cryptography and efficient batch operations are proposed to improve scalability for large-scale FL networks.Examples include communication-efficient masking, lightweight additive HE, batch encryption, SIMD, and parallelized FPGA or GPU architectures.
- PPAgg protocols do not protect FL systems against poisoning attacks, so verification techniques such as TEE, blockchain, VSS, and verifiable computation are considered.
- Inference attacks can still cause privacy leakage in some PPAgg systems, including attribute-inference risks under LDP-based aggregation.
7 CONCLUSIONS
The paper surveys privacy-preserving aggregation protocols for federated learning, reviews their supporting tools and applications, and identifies challenges and future research directions.
- The survey reviews PPAgg constructions that address diverse privacy issues in FL systems and analyzes their advantages and disadvantages.
- It also outlines existing challenges and several directions for future research in privacy-preserving federated learning.