PaperlayerView exact revision on arXiv

Source-linked AI summary

Progressive-Resolution Secure Aggregation for Federated Learning

Seyed Mohammad Azimi-Abarghouyi

arXiv:2610.00695v1cs.CRcs.DCcs.ITcs.LGmath.IT

TL;DR

Conventional secure aggregation fixes aggregate precision at upload, although an approved analysis may need only a coarse view. PSA represents updates as compatible nested-lattice layers and seals each aggregate layer until authorization. The reported experiments show payload and accuracy trade-offs that depend on the release regime.

  • Problem

    Conventional secure aggregation fixes aggregate precision when clients upload, even though later approved analyses may require only a coarser view.

    Source: §I · p. 1

  • Method

    PSA uses compatible nested-lattice layers for one-upload coarse-to-fine aggregate reconstruction, with a release pad that hides each layer until authorization.

    Source: B. Threat Model and Scope · p. 3, §XI · p. 12

  • Results

    In the reported experiments, PSA coincides with the matched flat mechanism at R = 1, while multiple authorized resolutions under ℓ2 clipping lower finest-resolution accuracy with independent stage noise and reduce arithmetic payload relative to repeated flat executions.

    Source: §XI · p. 12

  • Takeaways & Limitations

    The reported rotated coordinatewise-clipped regime reaches statistical parity with its matched rotated baseline while retaining one-upload progressive release.

    Source: §XI · p. 12

    The smaller concentration margin requires independent zero-mean layer symbols, while the matching margin lower bound applies only to layerwise modular interfaces.

    Source: §X · p. 12

Abstract

from arXiv · show

Secure aggregation lets a server recover an aggregate of client updates without observing any individual update, but conventional protocols fix the aggregate precision when clients upload. We introduce and formulate a new progressive-resolution secure-aggregation functionality in which clients upload once and successively finer resolutions of the same aggregate can later be authorized without renewed client participation. To realize this functionality, we propose progressive-resolution secure aggregation (PSA): each clipped, dithered update is represented by compatible nested-lattice digits; separately releasable layers are protected by secure aggregation and an additional aggregate pad that remains unavailable to the server until a non-colluding release controller authorizes that layer.

I. INTRODUCTION

Conventional secure aggregation fixes disclosure precision at upload, while PSA targets coarse-to-fine authorization of a consistent aggregate after one upload. Its design combines compatible nested-lattice layers with a separately controlled release gate.

I. INTRODUCTION

  • The paper motivates minimum-necessary-resolution release because decoding a fine aggregate and rounding it afterward cannot undo the finer disclosure; approved analyses may need only a coarse view.The introduction notes that clients in cross-device settings may be unavailable for a second upload.Source: §I · p. 1

A. Contributions

  • PSA formalizes post-upload authorization of successively finer aggregate resolutions without renewed client participation.Its architecture combines compatible nested-lattice layers, modular secure aggregation, and aggregate release pads.Source: §I · pp. 1–2, A. Contributions · p. 2
  • For K clients and radix ρ, the paper characterizes carries from separate modular reductions and derives a worst-case-data margin of order log_ρ K.For interfaces exposing each separately authorized release only through one modular sum, a 1/2 log_ρ K + O(1) margin order is necessary under an i.i.d. uniform-digit prior; this converse is not a lower bound for arbitrary interactive or jointly encoded protocols.Source: A. Contributions · p. 2
  • The paper also gives release-by-release Rényi-DP accounting and quantization-error analyses, and evaluates PSA on MNIST and CIFAR-10 against distributed discrete-Gaussian and Skellam mechanisms at matched privacy targets.Its contribution summary also describes exact finite-alphabet calculations of carry and arithmetic-payload scaling.Source: A. Contributions · p. 2

II. RELATED WORK

  • Prior secure aggregation and distributed-DP mechanisms address single released sums, while delayed-decryption tools can implement a gate but do not supply PSA’s consistent coarse-to-fine aggregate representation –,,.Earlier quantization work uses nesting mainly for rate–distortion or adaptation, whereas PSA assigns it to authorization order –[11].Source: §II · p. 2

A. Lattice Notation and Compatible Digits

  • Nested lattices provide closure under integer combinations, but PSA additionally requires digit compatibility so successive quantizer differences are valid bounded representatives –.The paper uses a balanced odd-radix integer chain as its canonical construction.Source: §II · p. 2, A. Lattice Notation and Compatible… · pp. 2–3

IV. PROGRESSIVE-RESOLUTION SECURE AGGREGATION

PSA processes clipped, recentered client updates in lattice blocks and encodes them for separately releasable aggregate layers. Its delayed-release scope depends on a non-colluding gate and the stated pad conditions.

A. Setting

  • Clients clip updates around a shared reference and process them in lattice blocks, zero-filling the last block when needed.Recentering, typically on the previous global model, reduces the range the lattice chain must cover.Source: A. Setting · p. 3

B. Threat Model and Scope

  • Delayed aggregate release assumes the server does not collude with the controller or trustee threshold before authorization; active poisoning and traffic analysis are excluded.Participation metadata and released-layer identities are public, and the controller receives neither individual updates nor an unmasked aggregate.Source: B. Threat Model and Scope · p. 3

C. Client Encoding

  • Clients scale clipped updates, add independent public subtractive dithers, and quantize to the lattice; the dithered quantization error is zero-mean and bounded by the covering radius.A sufficient range condition places each quantized point inside the coarsest lattice’s centered Voronoi region.Source: C. Client Encoding · p. 3
  • Under digit compatibility, the client’s quantized point decomposes into layer symbols whose refinements reconstruct the same point; clients add independent, zero-mean lattice noise per layer.For the integer-chain instantiation, the noise is discrete Gaussian.Source: C. Client Encoding · p. 3

D. Per-Layer Secure Aggregation and Sealed Release

Each separately releasable layer is secured as an aggregate modular sum with an additional pad that remains unavailable until authorization. Finer stages can be authorized without another client upload, at a communication cost shaped by release granularity.

D. Per-Layer Secure Aggregation and Sealed Release

  • Each layer uses an overflow margin and modular quotient, while active clients contribute independent release-pad shares.The aggregate pad is uniform from the server’s view if at least one active honest client supplies an independent uniform share unknown to the server.Source: D. Per-Layer Secure Aggregation and… · pp. 3–4
  • Ordinary SecAgg masks cancel at aggregation, but the aggregate release pad remains until authorization.The controller is assumed able to recover the pad for the realized active set without renewed client participation; that capability is assumed rather than constructed.Source: D. Per-Layer Secure Aggregation and… · p. 4
  • Authorizing one finer layer requires one controller token and no new client upload; an optional common orthogonal rotation can spread update energy across coordinates.The rotation changes neither the subsequent algebra nor privacy accounting.Source: D. Per-Layer Secure Aggregation and… · p. 4
  • Contiguous layers can be grouped into stages, with policy releasing stages in reverse fine-to-coarse arithmetic order; one layer per stage gives the finest authorization granularity.The extremes are one stage per layer and one flat stage containing all layers; a concentration margin of 1/2 log_ρ K + O(1) original-radix steps is stated for the grouped chain.Source: D. Per-Layer Secure Aggregation and… · p. 4
  • With one layer or one stage containing all layers, PSA reduces to one quantized modular sum plus an optional release gate; zero release pads recover ordinary SecAgg arithmetic when immediate disclosure is allowed.The paper characterizes an arithmetic-payload premium for separately authorized releases.Source: D. Per-Layer Secure Aggregation and… · p. 4

E. Secrecy of an Unreleased Layer

An unreleased layer is hidden by an independent uniform aggregate pad, while authorized modular sums can still incur carries. The paper bounds carry probability under either worst-case data or an additional concentration assumption.

E. Secrecy of an Unreleased Layer

  • An independent uniform pad makes an unreleased noisy modular sum conditionally independent of the server’s view, so its sealed ciphertext adds no information about that layer.After the pad is released, the server learns exactly the noisy modular sum; pseudorandom pads provide a computational rather than information-theoretic statement.Source: E. Secrecy of an Unreleased Layer · p. 4

V. EXACTNESS, CARRIES, AND OVERLOAD

  • A carry is zero exactly when the noisy layer sum lies in the centered Voronoi region; any nonzero carry has norm at least twice the packing radius.Overflow margins are chosen to make carries absent with high probability, since DP noise is unbounded.Source: §V · pp. 4–5
  • A carry on an unreleased finer layer cannot alter a coarser authorized output, although a carry on a coarse layer is not thereby small.Only carries at or above the authorized layer contribute to reconstruction error at that resolution.Source: §V · p. 5
  • Subtractive dithering makes quantization error unbiased but does not establish the zero-mean layer-symbol assumption; its suitability for federated updates remains an empirical workload question.The smaller-margin concentration rule therefore requires an assumption distinct from dithered quantization.Source: §V · p. 5
  • The theorem gives a worst-case margin without a distributional assumption and a smaller margin under zero-mean, independent layer-symbol assumptions, with separate data-concentration and noise-tail failure terms.Across layers, the stated carry-probability bounds are δ_z for the worst-case rule and δ_w + δ_z for the concentration rule.Source: §V · p. 5

VI. COMMUNICATION ACCOUNTING

Progressive refinement requires clients to upload a separately sealed message for each authorization stage. Its arithmetic-payload overhead grows with the number of stages, while the stated converse is limited to PSA’s modular interface.

VI. COMMUNICATION ACCOUNTING

  • The per-dimension arithmetic payload is one extended-quotient message per authorization stage, with each stage carrying its layer values and overflow margin.The count excludes SecAgg key exchange, authentication, dropout-recovery communication, and controller or trustee key-management traffic.Source: §VI · p. 5
  • For fixed radix and layer count, worst-case provisioning gives a gap of (R − 1) log2 K + O(R) bits per dimension over a one-stage payload.The stated asymptotics are in K for fixed ρ and L; if L grows, log L terms from failure allocation must be retained.Source: §VI · p. 5
  • The payload cost is driven by the number of separately sealed moduli, so finer refinement granularity—not simply the number of layers—sets the margin overhead.Each modulus contributes a margin of log2 K + O(1) bits under worst-case provisioning.Source: §VI · p. 5
  • The arithmetic penalty is not a universal lower bound because interactive coding or joint cross-layer encoding exposes a different sufficient statistic.The converse fixes the one-modular-sum-per-authorized-stage interface used by PSA.Source: §VI · p. 5

A. Converse for Layerwise Modular Interfaces

Within the layerwise modular interface, separately authorized releases require an arithmetic-payload premium under an i.i.d. uniform-digit prior. The converse does not claim necessity for interactive or jointly encoded protocols.

A. Converse for Layerwise Modular Interfaces

  • A layerwise modular interface reveals only each layer’s client-sum residue modulo its stage modulus, together with data-independent randomness.This interface includes PSA’s masks and release pads from the decoder’s viewpoint.Source: A. Converse for Layerwise Modular… · p. 6
  • The arithmetic-payload order is unavoidable only within the layerwise modular class under the uniform-digit prior; no lower bound is claimed for jointly encoded or interactive protocols.Separate pads enforce coarse-only authorization without recontacting clients.Source: A. Converse for Layerwise Modular… · p. 6

VII. DIFFERENTIAL PRIVACY OF AUTHORIZED RELEASES

The paper bounds privacy for separately authorized releases by composing their layer-level RDP costs. Its accounting depends on the active sensitivities and noise assumptions, and it excludes unreleased sealed layers from the server’s leakage.

A. Layer Sensitivity

  • Layer sensitivities must be summed rather than telescoped because an arbitrarily small input change can alter every layer symbol at once.Under global ℓ2 clipping, the actual full-vector sensitivity can be smaller than the worst-case product bound and should be used when available.Source: A. Layer Sensitivity · p. 6
  • Inactive layers with zero effective sensitivity are omitted from the privacy sum when the admissible block domain cannot activate their quantizers.For authorized sets, only mechanisms whose tokens are released enter the composition.Source: A. Layer Sensitivity · p. 6, B. Composition Across Authorized Layers · p. 6

B. Composition Across Authorized Layers

  • Authorized layer mechanisms compose additively in RDP, while a uniformly sealed, unreleased layer adds no leakage to the server transcript.The accounting applies to authorization stages as mechanisms under a grouped schedule, and release decisions based on additional private information need separate analysis.Source: B. Composition Across Authorized Layers · pp. 6–7
  • The concrete integer-chain analysis uses product discrete-Gaussian noise, relying only on honest clients’ noise shares and accounting for the non-Gaussian convolution residual.Reported (ε, δ) comparisons use RDP conversion and calibration at matched (ε, δ).Source: B. Composition Across Authorized Layers · p. 7
  • Extending the discrete-Gaussian constants to nonproduct lattices requires convolution analysis and noise above the lattice smoothing parameter; self-similarity alone is insufficient.The geometric carry results apply to every chain satisfying Assumption 1.Source: B. Composition Across Authorized Layers · p. 7

C. Leading Privacy Cost of Layering

The leading privacy cost depends on layer sensitivities and how the noise budget is allocated. Under a full-range balanced-digit condition, the leading bound can be neutral relative to a matched flat representation.

C. Leading Privacy Cost of Layering

  • The leading privacy budget should be allocated where a client can move the output furthest, according to each layer’s sensitivity.The comparison fixes a nominal per-coordinate noise-scale budget, not exact equal distortion at finite parameters.Source: C. Leading Privacy Cost of Layering · p. 7
  • For one full-range integer block, or products of such blocks under coordinate-wise range constraints, the leading privacy ratio is exactly 1 against a matched flat representation.The comparison uses the same noise-scale budget.Source: C. Leading Privacy Cost of Layering · p. 7
  • This neutrality is limited to the balanced digit-alphabet regime; under global ℓ2 clipping, layer sensitivities need not sum to the flat sensitivity.Finite-parameter optima can also shift with the noise-scale constraint, convolution corrections, and actual output variances.Source: C. Leading Privacy Cost of Layering · p. 7

VIII. DISTORTION ANALYSIS

The analysis separates the full-resolution quantization floor from truncation error, whose geometric scaling depends on uniform residues. Numerical evaluation examines carry margins and digit compatibility.

VIII. DISTORTION ANALYSIS

  • Theorem 4 gives moments for the ideal estimator, whose zero-carry event has probability at least 1 − δw − δz under its concentration rule and stated independence and zero-mean assumptions.The assumptions include independent client data-and-dither pairs, zero-mean skipped refinements, and independent zero-mean DP noise.Source: §VIII · p. 8
  • At full resolution, per-client error is exactly nbσ2(Λ1); truncated-release error adds a term whose Θ(ρ^2(ℓ0−1)) scaling requires uniform residues.Without that condition, only the universal upper scaling O(ρ^2(ℓ0−1)) follows; DP noise contributes separately at every authorized stage.Source: §VIII · p. 8
  • Client refinements can be correlated because they share data and dither; bounds use actual Tℓ0 and apply to non-identically distributed clients.The cross term is bounded rather than evaluated using only individual second moments.Source: §VIII · p. 8

IX. NUMERICAL EVALUATION

  • The evaluation uses exact finite-alphabet computation for carry margins and compatibility, controlled sources for distortion and privacy, and MNIST and CIFAR-10 experiments for digit-model and matched-baseline trade-offs.The experimental comparisons are against distributed discrete-Gaussian and Skellam mechanisms at matched privacy.Source: §IX · p. 8

A. Carries, Margins, and Digit Compatibility

  • 2 at K = 8 to 5 at K = 4096 are the smallest feasible margins; the regression slope is 0.548 against predicted 1/2, with an integrality offset.The reported rate premium is 19.02 bit per dimension at K = 1000, against the asymptotic 15.00.Source: A. Carries, Margins, and Digit… · p. 8
  • Across 2 × 10^5 points, the integer chain has no compatibility violations, while the self-similar A2 chain fails membership in 14.4%, 14.8%, and 13.1% of trials.Telescoping holds for A2, but self-similarity alone does not deliver digit compatibility.Source: A. Carries, Margins, and Digit… · p. 8

B. When Layering Is Free, and When It Is Not

The privacy cost of progressive layering depends on how well active layers are filled, while refinement trades lower quantization error against noise from additional stages. Federated experiments show a trade-off among accuracy, payload, and privacy composition compared with repeated flat releases.

B. When Layering Is Free, and When It Is Not

C. Distortion and the Two Error Sources

  • At the coarsest level, closed-form Tℓ0 deviates from measured second moment by 13.0% for uniform and 58.6% for Gaussian sources, so accuracy statements should use measured T or the bounds.Source: C. Distortion and the Two Error Sources · p. 9
  • Per-client truncation error falls by close to ρ^2=9 per refinement, and measured errors remain within the bounds, including for a Gaussian source.Source: C. Distortion and the Two Error Sources · p. 9, Figure 3 · p. 10
  • At ε=4, quantization error falls from 0.214 to 3 × 10^-4, while total error rises from 9.52 at ℓ0=4 to 19.48 at ℓ0=2 as added stage noise exceeds removed truncation error.The final increase to 19.58 is within the ±0.61 confidence interval; this behavior is specific to independent-stage noise, not a lower bound on progressive release.Source: C. Distortion and the Two Error Sources · p. 9, Figure 3 · p. 10

D. Federated Evaluation

  • At R=4, PSA accuracy is 0.709 versus 0.839 for repeated flat at ε=30; payload is 0.77× and privacy composition is ε=2.00 versus ε=4.29.Source: Table I · p. 10, D. Federated Evaluation · p. 11
  • On CIFAR-10 the finest provisioned layer is essentially unoccupied, while all four MNIST layers are occupied; measured occupancy can guide depth because empty layers also raise privacy cost.Source: D. Federated Evaluation · p. 10
  • Compression-only accuracy nearly matches the uncompressed non-private reference on MNIST and CIFAR-10, so private-arm accuracy differences are attributed to privacy accounting rather than the lattice code.Source: D. Federated Evaluation · p. 11

E. The Rotated Domain: Closing the Layering Penalty

The rotated coordinatewise-clipped regime closes the measured layering penalty: PSA reaches statistical parity with a matched rotated baseline while supporting four-resolution release from one upload. The paper also bounds the interface-specific margin and payload costs and identifies construction and deployment limits.

E. The Rotated Domain: Closing the Layering Penalty

  • At L=4 and γ=2, the leading composition ratio falls from 25.1 to 3.8, while the measured coordinate-clipping rate stays below 10^-4.This instantiation uses a public common rotation and coordinatewise clipping, retaining the surviving ℓ2 bound in sensitivity accounting.Source: E. The Rotated Domain: Closing the… · p. 11
  • 0.859 vs 0.714 on MNIST and 0.380 vs 0.245 on CIFAR-10 at ε=30, R=4; rotated PSA beats repeated flat, but is statistically at parity with the rotated baseline.Across the full (ε, dataset) sweep, the margin over repeated flat exceeds 0.08 in every cell and seed; paired differences against the rotated baseline are positive on MNIST but small and mixed on CIFAR-10.Source: E. The Rotated Domain: Closing the… · p. 12

X. DISCUSSION AND LIMITATIONS

  • PSA separates individual-upload secrecy, aggregate differential privacy, and authorization timing; compromising the release gate removes delayed authorization, while omitting DP removes the aggregate DP guarantee.Pairwise SecAgg masks cancel in the aggregate and therefore cannot replace the release gate.Source: §X · p. 12
  • The 1/2 log_ρ K concentration-order margin is necessary only within the layerwise modular interface under an i.i.d. uniform-digit prior, not for jointly encoded or interactive protocols.Arithmetic payload grows with the number of separately sealed moduli, so deployments can trade release granularity against payload through the number of stages R.Source: §X · p. 12
  • Exact layered reconstruction is proved for the balanced integer chain, not from self-similarity alone; smaller concentration margins require Assumption 2, and the product-integer discrete-Gaussian RDP bound does not automatically extend to nonproduct lattices.The leading accounting comparison's neutral case depends on the admissible domain.Source: §X · p. 12
  • Production release-gate deployment still requires pad recovery tied to the active set, audited key derivation and domain separation, rollback protection, and malicious-input validation.The independent-stage-noise accuracy loss under ℓ2 clipping is construction-specific, not a lower bound; the rotated regime removes it empirically at R=4, while correlated noise remains a candidate.Source: §X · p. 12

XI. CONCLUSION

  • Separate release pads hide unauthorized stage sums, but each separately sealed modulus adds arithmetic-payload cost.The conclusion's converse remains confined to the layerwise modular interface; the multi-stage accuracy gap under independent stage noise and ℓ2 clipping motivates investigation of alternative noise couplings.Source: §XI · p. 12
  • Exact calculations support the predicted margin and payload scaling; independent stage noise under ℓ2 clipping lowers finest-resolution accuracy, whereas rotated PSA reaches statistical parity with a matched rotated baseline.The R=1 check coincides bitwise with the matched flat mechanism, and compression-only lattice representation changes accuracy by at most 0.13 percentage points in the reported runs.Source: §XI · p. 12

APPENDIX A PROOF OF THEOREM 1

The appendix bounds overflow by controlling the signal and noise tails, then proves the interface-specific converse by reducing recovery to one modular residue. Its final proof derives stagewise distortion bounds from unwrapped released sums.

APPENDIX A PROOF OF THEOREM 1

  • Theorem 1's proof bounds the layer sum by K r_(ℓ+1) in the worst case and uses vector Bernstein under Assumption 2 for independent zero-mean summands; a noise-tail condition and union bound control carry probability.The sufficient threshold covers variance- and range-dominated regimes, with the stated probability budgets yielding the theorem's bound.Source: Appendix A · pp. 12–13

APPENDIX B PROOF OF THEOREM 2

  • Theorem 2's converse gives a genie the exact sums from other layers, reducing recovery to one layer's modular residue; bounding its optimal success probability yields the necessary margin.The proof uses the residue observation t_ℓ=S_ℓ mod M_ℓ and the local limit bound on the largest point probability.Source: Appendix B · p. 13

APPENDIX C PROOF OF THEOREM 4

  • Theorem 4's proof unwraps every authorized stage to its true integer sum and subtracts the quantization relation to obtain the distortion decomposition; vanishing cross terms yield the stated moment bound.Under the uniform-residue law, both bounds have geometric order for ℓ₀≥2; without it, the support bound gives O(ρ^(2(ℓ₀−1))) but no matching lower bound.Source: Appendix C · p. 13
Loading 2610.00695v1…