Practical Secure Aggregation for Federated Learning on User-Held Data

By Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, Karn Seth. 2016

662 citations recorded by the source corpus.

Secure Aggregation protocols allow a collection of mutually distrust parties, each holding a private value, to collaboratively compute the sum of those values without revealing the values themselves. We consider training a deep neural network in the Federated Learning model, using distributed stochastic gradient descent across user-held training data on mobile devices, wherein Secure Aggregation protects each user's model gradient. We design a novel, communication-efficient Secure Aggregation protocol for high-dimensional data that tolerates up to 1/3 users failing to complete the protocol. For 16-bit input values, our protocol offers 1.73x communication expansion for $2^{10}$ users and $2^{20}$-dimensional vectors, and 1.98x expansion for $2^{14}$ users and $2^{24}$ dimensional vectors.

Subfields: Artificial Intelligence, Federated & Distributed Learning, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Federated & Distributed Learning

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, background): “Compatibility with differential privacy and secure aggregation Many algorithms used in federated learning such as Secure Aggregation [72] and mechanisms of adding noise to achieve differential privacy [7, 290] are not designed to work with compressed or quantized communications.”
The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation (2021, methodology): “There is already ample work on implementing secure aggregation (Bell et al., 2020; Bonawitz et al., 2016); thus we treat SecAgg as a black box which is guaranteed to faithfully compute the modular sum of the inputs, while revealing no further information to a potential privacy adversary.”
SplitNN-driven Vertical Partitioning (2020, methodology): “…as STC (Sattler et al. , 2019) or Random Rotation Matrix (Koneˇcný et al. , 2017) as well as privacy preserving techniques such as Secure Aggregation Protocol (Bonawitz et al. , 2016) or minimizing Distance Correlation (Vepakomma et al. , 2019), as well as their effect on the computational cost.”
FedML: A Research Library and Benchmark for Federated Machine Learning (2020, methodology): “…robust [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 22], and proposing methods such as differential privacy (DP) and secure multiparty computation (SMPC) to protect privacy [25, 26, 27, 28, 29, 30, 31, 32, 33] (see Table 8 in the appendix for a taxonomy of the federated learning literature).”
Attack of the Tails: Yes, You Really Can Backdoor Federated Learning (2020, background): “SecAgg [46] is a variant which provably ensures that a client’s model and data cannot be inspected by the parameter server during FedAvg.”
Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learning (2020, background): “To prevent such information leakage, secure aggregation protocols ensure that the individual update of each user is kept private, both from other users and the central server [2], [3].”
Differentially Private Learning with Adaptive Clipping (2019, positive): “The method uses a negligible amount of privacy budget, and is compatible with other FL technologies such as compression and secure aggregation [5, 6].”
Federated Learning Of Out-Of-Vocabulary Words (2019, background): “FL can also be combined with privacy-preserving techniques like secure aggregation (Bonawitz et al., 2016) and differential privacy (McMahan et al.”
Federated Heavy Hitters Discovery with Differential Privacy (2019, methodology): “In particular, a cryptographic secure sum protocol such as that of (Bonawitz et al., 2016) can be used to count votes, so the service provider never sees individual votes, only the aggregate sum over all users in the round (and only if a suﬃcient number of users participate).”
Federated Learning for Mobile Keyboard Prediction (2018, background): “Federated learning has previously been shown to be complementary to privacy-preserving techniques such as secure aggregation [26] and differential privacy [17].”
DRACO: Byzantine-resilient Distributed Training via Redundant Gradients (2018, background): “This work shares ideas with federated learning, in which training is distributed among a large number of compute nodes without centralized training data (Konečnỳ et al., 2015; 2016; Bonawitz et al., 2016).”
Distributed Mean Estimation with Limited Communication (2016, positive): “advantages: it uses fixed length coding and hence can be combined with encryption schemes for privacy preserving secure aggregation (Bonawitz et al., 2016).”
Communication-Efficient Learning of Deep Networks from Decentralized Data (2016, methodology): “[6] introduced an efficient secure aggregation protocol for federated learning, and Konečný et al.”
LoAdaBoost: Loss-based AdaBoost federated machine learning with reduced computational complexity on IID and non-IID intensive care data (2018, methodology): “[9] designed the Secure Aggregation protocol to protect the privacy of each client’s model gradient in federated learning, without sacrificing the communication efficiency.”
Adaptive Federated Learning in Resource Constrained Edge Computing Systems (2018, background): “For example, a mechanism for secure global aggregation is proposed in [18].”
Distilled One-Shot Federated Learning (2020, background): “However, secure multiparty computation makes it possible for client model parameters to remain secret while still computing the average [3].”
Overcoming Forgetting in Federated Learning on Non-IID Data (2019, methodology): “We see no reason why secure aggregation methods [14] which were successfully applied to FedAvg could not be applied to FedCurv.”