[Paper Review] Samplable Anonymous Aggregation for Private Federated Data Analysis

Kunal Talwar, Shan Wang+35 more|arXiv (Cornell University)|Jul 27, 2023

Cryptography and Data Security4 citations

TL;DR

This paper introduces Samplable Anonymous Aggregation (SA₂), a novel cryptographic primitive enabling differentially private federated learning and analytics with privacy-utility trade-offs nearly matching those of the central trusted curator model. By combining client-side sampling, secret sharing across multiple servers, and anonymized aggregation, SA₂ achieves strong privacy guarantees without requiring a single trusted party, enabling scalable, secure, and efficient deployment in real-world systems.

ABSTRACT

We revisit the problem of designing scalable protocols for private statistics and private federated learning when each device holds its private data. Locally differentially private algorithms require little trust but are (provably) limited in their utility. Centrally differentially private algorithms can allow significantly better utility but require a trusted curator. This gap has led to significant interest in the design and implementation of simple cryptographic primitives, that can allow central-like utility guarantees without having to trust a central server. Our first contribution is to propose a new primitive that allows for efficient implementation of several commonly used algorithms, and allows for privacy accounting that is close to that in the central setting without requiring the strong trust assumptions it entails. {\em Shuffling} and {\em aggregation} primitives that have been proposed in earlier works enable this for some algorithms, but have significant limitations as primitives. We propose a {\em Samplable Anonymous Aggregation} primitive, which computes an aggregate over a random subset of the inputs and show that it leads to better privacy-utility trade-offs for various fundamental tasks. Secondly, we propose a system architecture that implements this primitive and perform a security analysis of the proposed system. Our design combines additive secret-sharing with anonymization and authentication infrastructures.

Motivation & Objective

• To design a practical, scalable, and privacy-preserving primitive for federated data analysis that reduces reliance on a single trusted curator.
• To enable differential privacy guarantees in federated learning and analytics that are close to those achievable in the central trusted setting.
• To build a system architecture that supports efficient, anonymous, and samplable aggregation across devices with minimal trust assumptions.
• To address the limitations of existing approaches—such as secure multi-party computation, TEEs, and homomorphic encryption—by offering lower communication overhead and tighter privacy accounting.
• To demonstrate the feasibility and security of the proposed system through a detailed architecture and threat model analysis.

Proposed method

• Proposes Samplable Anonymous Aggregation (SA₂) as a new ideal functionality that enables aggregation over a random subset of clients while preserving client anonymity.
• Employs a two-server split-trust model based on the Prio system, where clients use additive secret sharing to distribute their data across servers.
• Introduces client-side sampling to allow the system to compute aggregates over a random subset of devices, improving privacy and reducing computational load.
• Uses anonymization and device authentication mechanisms to prevent deanonymization attacks and ensure input integrity.
• Applies differential privacy to the aggregated outputs, achieving privacy bounds close to those of the central moments accountant in the trusted curator model.
• Designs a system architecture that avoids multi-round interactions, minimizing client churn and communication overhead.

Experimental results

Research questions

• RQ1 Can a federated aggregation primitive be designed that achieves differential privacy guarantees close to the central trusted curator model without requiring full trust in a single server?
• RQ2 How can client anonymity and data sampling be integrated into a secure, scalable, and efficient system for federated learning and analytics?
• RQ3 What system architecture and cryptographic components are necessary to support practical deployment of such a primitive at scale?
• RQ4 Can the proposed primitive enable tighter privacy accounting than existing federated learning protocols while maintaining strong security guarantees?
• RQ5 How can trust be distributed across multiple servers without compromising performance or privacy?

Key findings

• The SA₂ primitive enables differentially private histograms and federated learning with privacy-utility trade-offs that are nearly indistinguishable from those achieved in the central trusted curator setting.
• The system achieves privacy bounds close to the moments accountant in the central setting, making it the first federated primitive to do so.
• The architecture supports aggregation over 22 billion device contributions in under a year, demonstrating real-world scalability.
• The use of client-side sampling and anonymous aggregation allows for tighter privacy accounting and reduces the risk of model poisoning attacks.
• The system is resilient to a single server compromise as long as at least one server remains honest, ensuring strong security under the split-trust model.
• The approach avoids multi-round client interactions, reducing complexity from client churn and improving deployment feasibility.