Secure Aggregation

Federated learning's promise is that the server never sees your data, but it does see your update — and an update can be inverted. Secure aggregation closes that gap: clients mask their updates so that individual ones are unreadable, while the masks cancel exactly when enough of them are summed. The server learns the total and nothing else.

Pairwise masks that cancel on summation, plus secret sharing so the protocol survives clients dropping out mid-round — which they do constantly on mobile. Cost grows with the number of clients per round rather than model size, so it is practical at the scale federated learning actually runs at. It protects against an honest-but-curious server and composes with differential privacy rather than replacing it.

Client i adds Σ sub _j  PRG(s sub _ij ) with signs chosen so masks cancel: Σ sub _i  (x sub _i  + mask sub _i ) = Σ sub _i  x sub _i  exactly. Dropouts break the cancellation, so shares of each pairwise seed are distributed in advance and reconstructed for whoever fails — the reason the protocol tolerates a fixed fraction leaving mid-round without leaking anything about those who stayed.