[Paper Review] Information Theoretic Secure Aggregation with User Dropouts

Yizhou Zhao, Sun Hua|arXiv (Cornell University)|Jan 19, 2021

Distributed Sensor Networks and Detection Algorithms4 citations

TL;DR

This paper studies information-theoretic secure aggregation in federated learning with user dropouts, proposing a two-round protocol where users send messages in rounds 1 and 2 to enable the server to compute the sum of inputs from surviving users while leaking no additional information. The key result is that when $ U > T $, the optimal communication cost is 1 symbol per user in round 1 and $ 1/(U-T) $ symbols per surviving user in round 2, achieving information-theoretic security against colluding servers and up to $ T $ compromised users.

ABSTRACT

In the robust secure aggregation problem, a server wishes to learn and only learn the sum of the inputs of a number of users while some users may drop out (i.e., may not respond). The identity of the dropped users is not known a priori and the server needs to securely recover the sum of the remaining surviving users. We consider the following minimal two-round model of secure aggregation. Over the first round, any set of no fewer than $U$ users out of $K$ users respond to the server and the server wants to learn the sum of the inputs of all responding users. The remaining users are viewed as dropped. Over the second round, any set of no fewer than $U$ users of the surviving users respond (i.e., dropouts are still possible over the second round) and from the information obtained from the surviving users over the two rounds, the server can decode the desired sum. The security constraint is that even if the server colludes with any $T$ users and the messages from the dropped users are received by the server (e.g., delayed packets), the server is not able to infer any additional information beyond the sum in the information theoretic sense. For this information theoretic secure aggregation problem, we characterize the optimal communication cost. When $U \leq T$, secure aggregation is not feasible, and when $U > T$, to securely compute one symbol of the sum, the minimum number of symbols sent from each user to the server is $1$ over the first round, and $1/(U-T)$ over the second round.

Motivation & Objective

• To address the challenge of secure sum computation in federated learning when user dropouts are unpredictable and may occur in multiple rounds.
• To model and analyze a two-round secure aggregation protocol that ensures the server learns only the sum of inputs from surviving users, even if some users drop out.
• To characterize the fundamental communication cost limits under information-theoretic security, where the server colludes with up to $ T $ users and sees all messages, including those from dropped users.
• To establish conditions under which secure aggregation is feasible, particularly in relation to the threshold $ T $ and the minimum number of surviving users $ U $.

Proposed method

• The protocol uses a two-round communication model: in round 1, all $ K $ users send messages based on their inputs and shared randomness; in round 2, only surviving users from round 1 send additional messages.
• The second-round messages are adaptively chosen based on the known set of surviving users from round 1, enabling the server to decode the sum of inputs from the surviving users only.
• Security is enforced via information-theoretic constraints: even with colluding servers and access to all dropped messages, the server must not learn any information beyond the sum of the surviving inputs.
• The analysis uses information-theoretic inequalities, including mutual information and entropy bounds, to derive lower bounds on message sizes and randomness requirements.
• Key equations include the use of conditional entropy and mutual information to prove that the minimum message size per user is $ 1 $ in round 1 and $ 1/(U-T) $ in round 2 when $ U > T $.
• The proof relies on constructing information-theoretic lower bounds through carefully chosen scenarios, such as when only two users survive, to derive constraints on message and randomness sizes.

Experimental results

Research questions

• RQ1 Under what conditions is information-theoretic secure aggregation with user dropouts feasible?
• RQ2 What is the minimum communication cost required to securely compute the sum of inputs from surviving users in a two-round protocol?
• RQ3 How does the presence of up to $ T $ colluding users affect the communication efficiency of secure aggregation with dropouts?
• RQ4 Can the server be prevented from learning any information beyond the sum, even when it observes messages from dropped users?
• RQ5 What is the optimal trade-off between security, robustness to dropouts, and communication cost in secure aggregation?

Key findings

• Secure aggregation is not feasible when $ U frac{1}{U-T} $ symbols per user in round 2.
• The minimum amount of shared randomness per user is at least $ K $ symbols, derived from information-theoretic lower bounds on mutual information and entropy.
• The protocol achieves information-theoretic security: even with full access to messages from dropped users and collusion with up to $ T $ users, the server learns only the sum of the surviving inputs.
• The communication cost is optimal in the sense that no protocol can achieve lower message sizes while satisfying the same security and correctness constraints.