Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Secure Aggregation in Federated Learning using Multiparty Homomorphic Encryption

Erfan Hosseini, Shuangyi Chen, Ashish Khisti

TL;DR

This work tackles secure aggregation in federated learning by extending multiparty homomorphic encryption (MPHE) with a Shamir-based secret-sharing setup that enables decryption from any threshold of $k$ out of $N$ clients, addressing client dropouts and new joiners. The Robust Secure Aggregation (RSA) framework couples a one-time setup with a collaborative decryption phase and introduces a smudging noise mechanism to preserve security during aggregation. It further integrates a gradient compression scheme that reduces encryption and communication costs while providing convergence guarantees, enabling scalable training with large gradient vectors. Theoretical analysis provides correctness bounds and semi-honest security proofs, and experiments show linear scalability and favorable performance compared to existing baselines, especially when combined with compression. The approach offers practical secure aggregation for cross-device FL with dynamic participation and manageable overhead.

Abstract

A key operation in federated learning is the aggregation of gradient vectors generated by individual client nodes. We develop a method based on multiparty homomorphic encryption (MPHE) that enables the central node to compute this aggregate, while receiving only encrypted version of each individual gradients. Towards this end, we extend classical MPHE methods so that the decryption of the aggregate vector can be successful even when only a subset of client nodes are available. This is accomplished by introducing a secret-sharing step during the setup phase of MPHE when the public encryption key is generated. We develop conditions on the parameters of the MPHE scheme that guarantee correctness of decryption and (computational) security. We explain how our method can be extended to accommodate client nodes that do not participate during the setup phase. We also propose a compression scheme for gradient vectors at each client node that can be readily combined with our MPHE scheme and perform the associated convergence analysis. We discuss the advantages of our proposed scheme with other approaches based on secure multi-party computation. Finally we discuss a practical implementation of our system, compare the performance of our system with different approaches, and demonstrate that by suitably combining compression with encryption the overhead over baseline schemes is rather small.

Secure Aggregation in Federated Learning using Multiparty Homomorphic Encryption

TL;DR

This work tackles secure aggregation in federated learning by extending multiparty homomorphic encryption (MPHE) with a Shamir-based secret-sharing setup that enables decryption from any threshold of out of clients, addressing client dropouts and new joiners. The Robust Secure Aggregation (RSA) framework couples a one-time setup with a collaborative decryption phase and introduces a smudging noise mechanism to preserve security during aggregation. It further integrates a gradient compression scheme that reduces encryption and communication costs while providing convergence guarantees, enabling scalable training with large gradient vectors. Theoretical analysis provides correctness bounds and semi-honest security proofs, and experiments show linear scalability and favorable performance compared to existing baselines, especially when combined with compression. The approach offers practical secure aggregation for cross-device FL with dynamic participation and manageable overhead.

Abstract

A key operation in federated learning is the aggregation of gradient vectors generated by individual client nodes. We develop a method based on multiparty homomorphic encryption (MPHE) that enables the central node to compute this aggregate, while receiving only encrypted version of each individual gradients. Towards this end, we extend classical MPHE methods so that the decryption of the aggregate vector can be successful even when only a subset of client nodes are available. This is accomplished by introducing a secret-sharing step during the setup phase of MPHE when the public encryption key is generated. We develop conditions on the parameters of the MPHE scheme that guarantee correctness of decryption and (computational) security. We explain how our method can be extended to accommodate client nodes that do not participate during the setup phase. We also propose a compression scheme for gradient vectors at each client node that can be readily combined with our MPHE scheme and perform the associated convergence analysis. We discuss the advantages of our proposed scheme with other approaches based on secure multi-party computation. Finally we discuss a practical implementation of our system, compare the performance of our system with different approaches, and demonstrate that by suitably combining compression with encryption the overhead over baseline schemes is rather small.

Paper Structure

This paper contains 40 sections, 17 theorems, 49 equations, 3 figures, 4 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Notation
  4. Shamir's Secret Sharing
  5. BFV Encryption Scheme
  6. Multiparty Homomorphic Encryption
  7. Setup Phase
  8. Decryption
  9. System Model
  10. Threat Model and Assumptions
  11. Privacy Goals
  12. Baseline
  13. Robust Secure Aggregation (RSA)
  14. Setup Phase
  15. Aggregation Phase
  16. ...and 25 more sections

Key Result

Theorem 1

10.1145/359168.359176 Given any set of $k$ shares, $\{(x_{a_i}, s_{a_i})\}_{i=0}^{k-1}$ generated according to shamir_construction, one can reconstruct the secret $s$ i.e., there exist a set of coefficients $\{r_i \}_{i=0}^{k-1}, r_i \in \mathbb{Z}_p$ such that In addition the polynomials $t_j$ in shamir_construction can also be constructed using these shares, i.e., the set $\{r_{i, j}\}_{i=0}^{k

Figures (3)

  • Figure 1: Total run-time of different schemes
  • Figure 2: Setup time and average aggregation time of RSA
  • Figure 3: Effect of $T$ on average iteration time of ASA and RSA

Theorems & Definitions (35)

  • Definition 1
  • Theorem 1
  • Remark 1
  • Theorem 2
  • Definition 2
  • Remark 2
  • Proposition 1
  • Proposition 2
  • proof
  • Remark 3
  • ...and 25 more