secure aggregation
definition: the problem of computing a multiparty sum where no party reveals its update in the clear—even to the aggregator.
benefits: a user’s device can share an update knowing that the service provider will only see that update after it has been averaged with those of other users.
privacy concerns
- based on the gradient: membership inference, property inference attacks, DLG algorithm.
- based on the final model: an attacker can infer a dataset property based on a set of queries to the black-box model.
existing privacy solutions
- secure multi-party computation (SMC)
SMC mainly utilizes Yao-s garbled circuits or secret sharing. But it does not satisfy cross-silo FL settings, insufficient for security requirements. - homomorphic encryption (HE)
- Paillier
- BatchCrypt: data-parallel computation and data compression. It improves efficiency, but it's easy to decrypt the ciphertext of others when a client colludes with the central server because all clients use the same secret. (colluding problem)
- Third-party distributes shares of secret keys.
- Multi-party homomorphic encryption: unacceptable data transmission cost.
- differential privacy (DP)
Injecting noise in updates which results in the degrading of model quality.
threat model
- honest but curious and allows colluding
- adversaries aim to steal the valued model or utilize the model data to infer the training data of some clients
requirement
- security
- achieve the highest possible value of the collusion threshold
- data and the final model only are visible to the data owners
- efficiency
- model quality
Seed homomorphic PRG
Multi-key homomorphic encryption
single-key: HE
- Paillier: only addition operation
- BFV and CKSS: additions and multiplications
all parties share the same key for encryption and decryption, and the decryption can be done independently by any party.
multi-key: MKHE
- MK-BFV: Ring Learning With Error based
