Secure Aggregation

"A Pairwise Mask, Born to Cancel, Living to Hide a Single Update."

A Random Vector That Sums to Zero

The federated training loop of this chapter has, by now, a clear shape. Each hospital holds private patient data it may not move, trains locally on that data, and sends a model update to a coordinator that combines the updates and broadcasts the improved model for the next round. Section 37.4 made the combine step concrete as federated averaging, and Section 37.3 argued that privacy is the binding constraint of the whole system, not an afterthought. A subtle gap remains. Federated averaging needs only the weighted sum of the updates, yet the coordinator receives every update individually before it adds them. A single hospital's update, inverted through a gradient-inversion attack, can leak the very patient records the federation was built to protect. Secure aggregation closes the gap: it lets the coordinator learn the sum and provably nothing else about any individual term.

1. The Sum Is All the Coordinator Needs Beginner

Recall the structure of the aggregation step. Site $i$ produces an update vector $x_i \in \mathbb{R}^d$, where $d$ is the number of model parameters (or the number of parameters in the layers being shared). The coordinator wants the sum

from which federated averaging recovers the mean by dividing by $n$, or by the total example count for the weighted variant of Section 37.4. This is exactly the reduce operation that opened the book: a sum over machines is the canonical all-reduce, the same primitive that combined gradients in Chapter 4 and synchronized data-parallel training in Chapter 14. What changes in the medical setting is the threat model around that sum. The coordinator is permitted to learn $\bar{x}$, because the aggregate of hundreds of hospitals reveals little about any one patient, but it must not learn $x_i$ for any single site, because one hospital's update can be inverted back toward its training records.

The design goal is therefore precise. We want a protocol in which every site sends the coordinator a message, the coordinator combines the messages into $\bar{x}$, and the individual messages reveal nothing about the individual updates beyond what $\bar{x}$ already implies. The cryptographic name for this guarantee is secure aggregation, and the elegant part is that it requires no homomorphic encryption and no trusted third party, only shared randomness that is built to cancel.

2. Pairwise Masks That Cancel Intermediate

The simplest construction that achieves cancelling randomness is pairwise additive masking. For every unordered pair of sites $\{i, j\}$, the two sites agree on a shared mask vector $s_{ij} \in \mathbb{R}^d$. They use it antisymmetrically: site $i$ adds $s_{ij}$ to its update while site $j$ subtracts the same vector. Writing $s_{ij} = -s_{ji}$ to capture that sign convention, each site forms its masked update

The coordinator receives only the $y_i$. Each one is the true update $x_i$ buried under a sum of $n-1$ fresh random vectors, so to the coordinator it is indistinguishable from a random draw and reveals nothing about $x_i$. Now form the global sum:

Every pairwise term appears exactly twice in the double sum, once as $s_{ij}$ from site $i$ and once as $s_{ji} = -s_{ij}$ from site $j$, so each pair contributes zero. The masks annihilate in aggregate and the coordinator is left with the exact true sum $\bar{x}$, having seen only noise along the way. Figure 37.6.1 shows the cancellation for four hospitals.

Two practical questions remain before this is a usable protocol. How do two sites agree on a shared mask vector $s_{ij}$ without a trusted dealer handing it to them, and what happens when a hospital that promised to contribute masks drops offline mid-round, leaving its masks uncancelled? The next two subsections answer these in turn.

3. Deriving the Masks from Key Agreement Intermediate

The two sites in a pair must arrive at the same vector $s_{ij}$ without ever transmitting it, because anything sent through the coordinator could be observed. Diffie-Hellman key agreement is exactly the tool. Over a cyclic group with public generator $g$, site $i$ samples a secret scalar $a_i$ and publishes $g^{a_i}$; site $j$ samples $a_j$ and publishes $g^{a_j}$. Each can then form the shared secret

which an eavesdropper who sees only $g^{a_i}$ and $g^{a_j}$ cannot compute under the Diffie-Hellman assumption. Both sides feed $k_{ij}$ into a pseudorandom generator seeded by that shared secret, and the generator expands it deterministically into the full mask vector $s_{ij} \in \mathbb{R}^d$. Because both sites seed the same generator with the same secret, they obtain the identical vector, and they apply it with opposite signs using the canonical ordering of their site identifiers (the lower id adds, the higher subtracts). The shared randomness is established by a single round of public-key exchange and never travels in the clear; only the short public values $g^{a_i}$ cross the network, while the mask itself is regenerated locally on each side. This is the same shared-secret-to-stream pattern the demo in Code 37.6.1 emulates with a per-pair integer seed in place of the Diffie-Hellman secret.

4. Surviving Dropout with Secret Sharing Advanced

Hospitals are not reliable network endpoints. A site can lose connectivity, a clinical workstation can be rebooted, a round can time out. If site $j$ commits masks with all its partners and then vanishes before the coordinator collects $y_j$, every mask $s_{ij}$ that survivors added against $j$ is now an orphan: there is no $y_j$ carrying the matching $-s_{ij}$ to cancel it, so the aggregate is corrupted by a pile of uncancelled noise. A protocol that fails whenever one of hundreds of sites blinks is not a protocol a hospital federation can run.

Shamir secret sharing supplies the robustness. Before masking, each site $j$ splits the secret material needed to regenerate its masks (concretely, its Diffie-Hellman secret $a_j$) into $n$ shares using a polynomial of degree $t-1$, and distributes one share to each other site. Any $t$ of the $n$ shares reconstruct the secret exactly through Lagrange interpolation, while any $t-1$ shares reveal nothing about it. The threshold property is

When site $j$ drops, the coordinator asks the surviving sites for their shares of $a_j$. As long as at least $t$ survivors respond, they reconstruct $a_j$, recompute the orphaned masks $s_{ij}$ that $j$ had agreed with each survivor, and the coordinator subtracts those masks from the partial aggregate, restoring an exact sum over the surviving updates. Figure 37.6.2 sketches this recovery. The threshold $t$ is the heart of the dropout-versus-privacy balance: it must be small enough that enough survivors remain to reconstruct after realistic dropout, yet large enough that the coordinator colluding with fewer than $t$ sites can never reconstruct an online site's secret and strip its mask while it is still participating.

5. The Threat Model and Its Boundaries Intermediate

A protocol is only as meaningful as the adversary it defends against, so the assumptions must be stated plainly. The standard secure-aggregation threat model is honest-but-curious (also called semi-honest): the coordinator and the sites follow the protocol faithfully, performing every step as specified, but they will try to infer everything they can from the messages they legitimately receive. Against this adversary, pairwise masking is unconditionally hiding for the individual updates, because each $y_i$ is a real update plus the sum of independent fresh masks, which is statistically independent of $x_i$. The coordinator learns the sum it is entitled to and nothing more.

The guarantee is bounded by collusion. If the coordinator colludes with a set of sites, the masks shared between two colluding sites are known to the coalition and cancel within it, so they no longer hide the honest sites' updates. The Shamir threshold $t$ sets the collusion bound directly: as long as fewer than $t$ parties collude, no online site's secret can be reconstructed and its mask cannot be removed, so privacy holds. Choosing $t$ is therefore a single knob that trades dropout tolerance (smaller $t$ tolerates more dropout) against collusion resistance (larger $t$ resists more collusion), and a real deployment sets it from the observed dropout rate and the trust assumptions among the participating institutions. A fully malicious adversary that deviates from the protocol, for example by reporting false shares or inconsistent public keys, needs the stronger verifiable variants noted in the research frontier below; the honest-but-curious model is the right starting point because it matches the realistic posture of regulated hospitals that will run the agreed software but would still mine any data that passes through them.

6. Secure Aggregation Meets Differential Privacy Advanced

Secure aggregation and differential privacy protect against different leaks, and a clinical federation needs both. Secure aggregation hides each individual update from the coordinator, but it does not constrain what the released sum reveals. The aggregate $\bar{x}$ itself can still leak: with auxiliary knowledge an adversary may reason about whether a particular patient's record influenced the sum, exactly the membership-style inference that differential privacy is designed to bound. The two mechanisms compose cleanly. Secure aggregation removes the need to trust the coordinator with raw updates, and differential privacy, introduced for distributed learning in Chapter 35 and motivated for this case study in Section 37.3, bounds what the released aggregate can reveal about any single record by injecting calibrated noise.

The composition is more than additive. In the distributed-DP construction, each site adds a small share of the privacy noise to its own update before masking; the masks still cancel in the sum, and the per-site noise shares add up to the full noise magnitude that the differential-privacy guarantee requires. Because secure aggregation hides the individual updates, no site has to add the full noise locally (which would destroy its own update's signal) and no trusted aggregator has to add the noise centrally (which would require trusting it). The federation gets central-DP-level accuracy with only the trust assumptions of local DP, a synergy that makes the pair far stronger together than either alone.

7. The Tension with Byzantine-Robust Aggregation Advanced

Secure aggregation buys privacy by making every individual update invisible to the coordinator, and that very invisibility collides with another defense the federation may need. Byzantine-robust aggregation, developed in Chapter 35, protects the model against a malicious or malfunctioning site that submits a poisoned update; its defenses, coordinate-wise median, trimmed mean, Krum, and their relatives, all work by inspecting and comparing the individual updates and discarding the outliers. Secure aggregation hands the coordinator a single sum and refuses to show it any individual update. The robust filter has nothing to inspect, and the poisoned contribution flows straight into the protected sum.

This is a real and active tension, not a detail to wave away: the privacy mechanism and the integrity mechanism want opposite things from the same updates, one to hide them and the other to scrutinize them. Three lines of work try to reconcile them. The first computes robust statistics inside the cryptographic envelope, evaluating a median or a norm bound on the masked data using secure multiparty computation so that filtering happens without anyone seeing the cleartext updates, at substantial extra protocol cost. The second relaxes the privacy target, revealing only coarse, privacy-preserving summaries such as bucketed norm histograms that are enough to reject the most extreme poison while leaking little about any single update. The third sidesteps the filter entirely by bounding each update's influence before it is masked, for example clipping every update to a fixed norm so that no single poisoned contribution can dominate the sum, which is also exactly the clipping that the differential-privacy guarantee of Section 6 requires. Naming the tension plainly is the point: a medical federation that needs both strong privacy and poisoning resistance cannot get both for free, and the choice among these three reconciliations is one of the genuinely open design decisions of the field.

8. The Protocol in Code Intermediate

The construction is easiest to trust once you watch the masks vanish. The program below implements pairwise antisymmetric masking for four hospitals, emulating each pair's shared secret with a per-pair integer seed that stands in for the Diffie-Hellman value of Section 3. It prints one hospital's true update next to the masked update the coordinator would see, confirms that the sum of masked updates equals the true sum to floating-point precision, and then enacts the dropout case of Section 4: hospital 4 goes offline, and the survivors' reconstructed knowledge of its shared masks lets the coordinator recover the exact sum over the remaining three.

import numpy as np

rng = np.random.default_rng(7)
n, d = 4, 6                                  # 4 hospitals, update dimension 6
true_updates = rng.standard_normal((n, d))   # each hospital's real update x_i

# Pairwise antisymmetric masks s_ij = -s_ji, derived from a shared per-pair seed.
# In practice the seed is a Diffie-Hellman shared secret; here we emulate it.
def pair_mask(i, j, d):
    seed = 1000 * min(i, j) + max(i, j)      # both parties derive the SAME seed
    m = np.random.default_rng(seed).standard_normal(d)
    return m if i < j else -m                # one side adds, the other subtracts

# Each hospital masks its update: y_i = x_i + sum_{j != i} s_ij
masked = np.zeros((n, d))
for i in range(n):
    y = true_updates[i].copy()
    for j in range(n):
        if j != i:
            y = y + pair_mask(i, j, d)
    masked[i] = y

print("True update of hospital 0 :", np.round(true_updates[0], 3))
print("Masked y_0 seen by server :", np.round(masked[0], 3))
print("  (looks like noise, hides the real update)")
print()

true_sum = true_updates.sum(axis=0)
masked_sum = masked.sum(axis=0)             # server only sums the masked y_i
print("Server sum of masked y_i  :", np.round(masked_sum, 6))
print("True sum of updates       :", np.round(true_sum, 6))
print("max abs difference        :", f"{np.max(np.abs(masked_sum - true_sum)):.2e}")
print()

# Dropout: hospital 3 goes offline AFTER masking. Its pairwise masks with the
# survivors no longer cancel. A Shamir t-of-n sharing of hospital 3's mask seeds,
# reconstructed by the survivors, lets the server subtract the orphaned masks.
survivors = [0, 1, 2]
dropped = 3
partial_sum = masked[survivors].sum(axis=0)         # what server has after dropout

# Reconstruct the masks the dropped site shared with each survivor and remove them.
orphan = np.zeros(d)
for s in survivors:
    orphan = orphan + pair_mask(s, dropped, d)      # mask survivor s added vs dropped
recovered = partial_sum - orphan
true_survivor_sum = true_updates[survivors].sum(axis=0)
print("Dropout case (hospital 3 offline):")
print("recovered sum of survivors:", np.round(recovered, 6))
print("true sum of survivors     :", np.round(true_survivor_sum, 6))
print("max abs difference        :", f"{np.max(np.abs(recovered - true_survivor_sum)):.2e}")

True update of hospital 0 : [ 0.001  0.299 -0.274 -0.891 -0.455 -0.992]
Masked y_0 seen by server : [ 2.577 -1.958  0.061 -5.203  1.798  0.383]
  (looks like noise, hides the real update)

Server sum of masked y_i  : [-1.734435 -0.581045 -2.637331 -1.050855 -2.57649  -0.821111]
True sum of updates       : [-1.734435 -0.581045 -2.637331 -1.050855 -2.57649  -0.821111]
max abs difference        : 5.55e-16

Dropout case (hospital 3 offline):
recovered sum of survivors: [ 0.166788  0.708493 -0.795596 -0.815764 -1.309043 -1.092375]
true sum of survivors     : [ 0.166788  0.708493 -0.795596 -0.815764 -1.309043 -1.092375]
max abs difference        : 7.77e-16

import tensorflow_federated as tff

# Replaces plain summation with the masked, dropout-robust secure-aggregation
# protocol: key agreement, pairwise masks, and Shamir sharing are all internal.
secure_sum = tff.aggregators.SecureSumFactory(
    upper_bound_threshold=1.0)             # clip each update's norm before masking

learning_process = tff.learning.algorithms.build_weighted_fed_avg(
    model_fn,
    model_aggregator=secure_sum)           # FedAvg now aggregates under the mask

Secure aggregation completes the privacy story this chapter has been building: the coordinator now learns the federated sum and nothing about any single hospital's contribution, dropout no longer breaks the round, and the same clipping that bounds privacy loss also blunts poisoning. The next section turns from how the updates are combined to how the federation is governed and audited over time, the operational layer that keeps a multi-institution medical model trustworthy across many rounds, beginning in Section 37.7.