[Paper Review] FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learning

Swanand Kadhe, Nived Rajaraman+2 more|arXiv (Cornell University)|Sep 23, 2020

Privacy-Preserving Technologies in Data32 references113 citations

TL;DR

FastSecAgg introduces an FFT-based multi-secret sharing scheme (FastShare) to enable scalable, secure aggregation in federated learning with dropout tolerance and adaptive adversaries.

ABSTRACT

Recent attacks on federated learning demonstrate that keeping the training data on clients' devices does not provide sufficient privacy, as the model parameters shared by clients can leak information about their training data. A 'secure aggregation' protocol enables the server to aggregate clients' models in a privacy-preserving manner. However, existing secure aggregation protocols incur high computation/communication costs, especially when the number of model parameters is larger than the number of clients participating in an iteration -- a typical scenario in federated learning. In this paper, we propose a secure aggregation protocol, FastSecAgg, that is efficient in terms of computation and communication, and robust to client dropouts. The main building block of FastSecAgg is a novel multi-secret sharing scheme, FastShare, based on the Fast Fourier Transform (FFT), which may be of independent interest. FastShare is information-theoretically secure, and achieves a trade-off between the number of secrets, privacy threshold, and dropout tolerance. Riding on the capabilities of FastShare, we prove that FastSecAgg is (i) secure against the server colluding with 'any' subset of some constant fraction (e.g. $\sim10\%$) of the clients in the honest-but-curious setting; and (ii) tolerates dropouts of a 'random' subset of some constant fraction (e.g. $\sim10\%$) of the clients. FastSecAgg achieves significantly smaller computation cost than existing schemes while achieving the same (orderwise) communication cost. In addition, it guarantees security against adaptive adversaries, which can perform client corruptions dynamically during the execution of the protocol.

Motivation & Objective

• Motivate privacy concerns in federated learning where updates may leak information.
• Design a secure aggregation protocol that scales to many clients and high-dimensional updates.
• Provide robustness to client dropouts while maintaining privacy guarantees.
• Achieve strong security even under adaptive adversaries.
• Offer practical computational and communication efficiency improvements over prior work.

Proposed method

• Propose FastShare, a multi-secret sharing scheme based on a finite-field FFT to share S secrets among N clients with information-theoretic privacy against a constant-fraction collusion.
• Use FastShare as the building block for FastSecAgg to securely compute the sum of client updates.
• Leverage a 2D grid representation and Chinese Remainder Theorem to enable efficient share generation and recovery.
• Provide formal privacy guarantees with a T-privacy threshold and D-dropout resilience.
• Analyze computational and communication costs and compare to prior secure aggregation protocols.

Experimental results

Research questions

• RQ1 Can FastShare securely share multiple secrets with information-theoretic privacy against colluding subsets of clients?
• RQ2 Can FastSecAgg achieve secure aggregation with lower server computation while tolerating realistic dropout rates?
• RQ3 What are the trade-offs between privacy threshold, dropout tolerance, and efficiency in the FFT-based scheme?
• RQ4 How does FastSecAgg perform under adaptive adversaries compared to non-adaptive models?

Key findings

• FastShare achieves information-theoretic privacy against colluding subsets of a constant fraction of clients and dropout tolerance with high probability.
• FastSecAgg reduces server computation compared to prior secure aggregation schemes while keeping similar order-wise communication costs.
• The protocol tolerates adaptive adversaries who can corrupt clients during execution.
• For N clients with length-L updates, the server computes with O(L log N) computation and O(LN + N^2) communication, while each client incurs O(L log N) computation and O(L + N) communication.
• FastShare enables a practical, scalable secure aggregation primitive applicable to broader secure MPC tasks.