[Paper Review] FLASHE: Additively Symmetric Homomorphic Encryption for Cross-Silo Federated Learning

Zhifeng Jiang, Wei Wang+1 more|arXiv (Cornell University)|Sep 2, 2021

Cryptography and Data Security62 references41 citations

TL;DR

FLASHE presents a lightweight, additively symmetric HE scheme for cross-silo FL that eliminates communication overhead and supports sparsification, with ≤6% training-time overhead over plaintext.

ABSTRACT

Homomorphic encryption (HE) is a promising privacy-preserving technique for cross-silo federated learning (FL), where organizations perform collaborative model training on decentralized data. Despite the strong privacy guarantee, general HE schemes result in significant computation and communication overhead. Prior works employ batch encryption to address this problem, but it is still suboptimal in mitigating communication overhead and is incompatible with sparsification techniques. In this paper, we propose FLASHE, an HE scheme tailored for cross-silo FL. To capture the minimum requirements of security and functionality, FLASHE drops the asymmetric-key design and only involves modular addition operations with random numbers. Depending on whether to accommodate sparsification techniques, FLASHE is optimized in computation efficiency with different approaches. We have implemented FLASHE as a pluggable module atop FATE, an industrial platform for cross-silo FL. Compared to plaintext training, FLASHE slightly increases the training time by $\leq6\%$, with no communication overhead.

Motivation & Objective

• Motivate privacy-preserving cross-silo FL and reduce HE overhead.
• Design a minimal, symmetric additive HE suitable for FL aggregation.
• Provide two variants to support sparsification or not.
• Integrate FLASHE with the FATE platform and evaluate in geo-distributed settings.

Proposed method

• Propose an additive HE where encryption adds random masks to plaintext within a modular group.
• Define E_k(m) = (c, i, {j}) with c_d = m_d + F_k(i||j||d) - F_k(i||j+1||d) mod n.
• Define decryption D_k to recover m from masked sums after aggregation.
• Introduce two masking strategies (double masking and single masking) and their trade-offs.
• Adapt the ciphertext structure to support sparsification and coordinate alignment.
• Evaluate end-to-end on FATE with 11 AWS instances across five data centers.

Experimental results

Research questions

• RQ1 Does FLASHE achieve semantic security and additive homomorphism suitable for FL aggregation?
• RQ2 What is the computational and communication overhead of FLASHE compared to plaintext and traditional HE schemes?
• RQ3 How does sparsification interact with FLASHE, and can masking schemes adaptively optimize performance?
• RQ4 What is the end-to-end performance (training time, monetary cost) in a real geo-distributed setting?
• RQ5 How does FLASHE impact sparsified model updates in terms of speed and network traffic?

Key findings

• Training time overhead with FLASHE is ≤6% compared with plaintext training.
• FLASHE introduces no additional network traffic compared to plaintext.
• FLASHE reduces cost versus optimized Paillier, FV, and CKKS by up to 73%–94%.
• Sparsified updates with FLASHE achieve 13–63× speedups and 48× network reduction vs Paillier.
• Double masking can offer better decryption efficiency in typical cross-silo dropout scenarios; single masking is more efficient for encryption.
• First HE proposal with optimized end-to-end performance for cross-silo FL.