RAIN: Secure and Robust Aggregation under Shuffle Model of Differential Privacy

TL;DR

Robust Aggregation in Noise (RAIN), a unified framework that reconciles privacy, robustness, and verifiability under Shuffle-DP, designs two novel secret-shared protocols for shuffling and aggregation that operate directly on additive shares and preserve Shuffle-DP's tight privacy guarantee.

Abstract

Secure aggregation is a foundational building block of privacy-preserving learning, yet achieving robustness under adversarial behavior remains challenging. Modern systems increasingly adopt the shuffle model of differential privacy (Shuffle-DP) to locally perturb client updates and globally anonymize them via shuffling for enhanced privacy protection. However, these perturbations and anonymization distort gradient geometry and remove identity linkage, leaving systems vulnerable to adversarial poisoning attacks. Moreover, the shuffler, typically a third party, can be compromised, undermining security against malicious adversaries. To address these challenges, we present Robust Aggregation in Noise (RAIN), a unified framework that reconciles privacy, robustness, and verifiability under Shuffle-DP. At its core, RAIN adopts sign-space aggregation to robustly measure update consistency and limit malicious influence under noise and anonymization. Specifically, we design two novel secret-shared protocols for shuffling and aggregation that operate directly on additive shares and preserve Shuffle-DP's tight privacy guarantee. In each round, the aggregated result is verified to ensure correct aggregation and detect any selective dropping, achieving malicious security with minimal overhead. Extensive experiments across comprehensive benchmarks show that RAIN maintains strong privacy guarantees under Shuffle-DP and remains robust to poisoning attacks with negligible degradation in accuracy and convergence. It further provides real-time integrity verification with complete tampering detection, while achieving up to 90x lower communication cost and 10x faster aggregation compared with prior work.

Figures (7)

• Figure 1: Effect of Shuffle-DP on aggregation robustness. Existing robust aggregation fails under Shuffle-DP: local noise distorts gradient geometry, anonymization removes identity continuity, and they are further vulnerable to tampering by the shuffler. RAIN preserves robustness under the same Shuffle-DP setting without relying on a trusted shuffler.
• Figure 2: Overview of the RAIN framework. Each client $C_i$ locally adds DP noise and sign-encodes its update into a binary vector, then sends secret shares to two non-colluding servers $S_0$ and $S_1$. The servers execute a verifiable shuffle to anonymize message origins, perform MAC-based integrity checks to reject dropped or tampered messages, and compute Hamming-distance consistency over the shuffled sign vectors. RAIN then aggregates the verified updates in the arithmetic domain and reconstructs the global model $\tilde{\mathbf{W}}$.
• Figure 3: Convergence of RAIN under Shuffle-DP ($\rho = 0$). Model accuracy (MA) over training iterations on FMNIST,and MNIST. RAIN achieves convergence comparable to FedAvg while significantly outperforming SignSGD in terms of stability and final accuracy across all datasets.
• Figure 4: Privacy–Robustness Trade-off of RAIN. As the privacy budget $\varepsilon$ decreases, stronger DP noise slightly reduces model accuracy but also lowers the attack success rate (ASR).
• Figure 5: Failure of existing robust aggregation methods under Shuffle-DP Geometry-based methods (Krum, Trim-Mean, FLOD, FLAME, etc.) and reputation-based methods (FLTrust, FoolsGold, DnC, CONTRA, FLARE, etc.) are evaluated under the adaptive Attack-DPFL across three datasets.

Theorems & Definitions (5)

• Definition 1: Central Differential Privacy
• Definition 2: Local Differential Privacy
• Definition 3: Shuffled Differential Privacy
• Lemma 1: Noise–Robustness Trade-off of RAIN
• proof